last executing test programs: 9.90749376s ago: executing program 1 (id=4668): r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000480), 0xa400, 0x0) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x7) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f00000004c0)=0x7) fsetxattr$security_capability(r0, &(0x7f0000000500), &(0x7f0000000540)=@v1={0x1000000, [{0x1ff, 0x4}]}, 0xc, 0x1) syz_io_uring_setup(0x7758, &(0x7f0000000580)={0x0, 0x929b, 0x400, 0x0, 0x33c, 0x0, r0}, &(0x7f0000000600)=0x0, &(0x7f0000000640)) syz_io_uring_setup(0x51bd, &(0x7f0000000680)={0x0, 0x9087, 0x10000, 0x3, 0x38f, 0x0, r0}, &(0x7f0000000700), &(0x7f0000000740)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000780)=@IORING_OP_WRITE_FIXED={0x5, 0x40, 0x6000, @fd=r0, 0x6, 0x7b, 0x69b8, 0x8, 0x1, {0x1, r3}}) clock_gettime(0x0, &(0x7f00000007c0)={0x0, 0x0}) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000840)=@userptr={0x7fff, 0xa, 0x4, 0x400, 0x4, {r4, r5/1000+60000}, {0x3, 0x0, 0x6, 0x57, 0x2, 0x5, "367847ff"}, 0x6, 0x2, {&(0x7f0000000800)}, 0x4, 0x0, r0}) sendto$inet(r0, &(0x7f00000008c0)="f93caf98dc12f64a3a926e3d7101da35fce79b7311d01a0db50e9ad96ffb206e1db47c3ff5281f58ef53be6a81276257523cd9cbf1a5c7294d0de100d798560e7220fd625abe94b36d21788c271186a70ef3", 0x52, 0x40090, &(0x7f0000000940)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, &(0x7f00000009c0)=0xffffffffffffffff) ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000a00)=@userptr={0x5, 0x8, 0x4, 0x40, 0x7, {0x0, 0xea60}, {0x4, 0xc, 0x4, 0x7f, 0x6, 0xd, "5ce05182"}, 0x8, 0x2, {&(0x7f0000000980)}, 0x1, 0x0, r6}) write$RDMA_USER_CM_CMD_CONNECT(r0, &(0x7f0000000a80)={0x6, 0x118, 0xfa00, {{0x80, 0xbee5, "e794c6e74dbeb78e20492a9161b1a96abe7d879a00e8b3abb5887c5ab7638c025f54ebcaa9fbb03c8ccc945ed8ae4f09939a0a1c1e8618340f0a5080c6b4973e05cfdc7758995076e4487277539f40278bd940e1bc3220ba0bfd8b54496793cf3276a997e7e87161c4ae724c7a71f6916932f27b16475df18b23a55b8c654f33182e799fa6747e1940c91e676e4a428f1971e2cee82589a4196dc21095c4f93f5d38b85aca9d7647241bf2ad9609092035f28e2276926b64ddd08f349784231da70260f3eb6ad02227f6ced3139147a9c14d366c9dec1553147bfc06d49d79af926177a2e669507027a4eed0548c81b60affe7dfcbd24cbece22428ca205d2b2", 0xa9, 0x6, 0x7, 0x4, 0xb9, 0x0, 0xe}}}, 0x120) bpf$MAP_CREATE(0x0, &(0x7f00000032c0)=@bloom_filter={0x1e, 0x18, 0x9, 0x8, 0x51c14, r0, 0x8, '\x00', 0x0, r0, 0x4, 0x1, 0x0, 0xf}, 0x50) 9.78654832s ago: executing program 1 (id=4669): socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) ioctl$IOC_PR_PREEMPT_ABORT(0xffffffffffffffff, 0x401870cc, &(0x7f00000002c0)={0x800f, 0x6, 0x7, 0x1}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r3 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000180)='net/unix\x00') r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f00000033c0), 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000000), 0x77, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={0x0, 0x70}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYRES16], 0x28}}, 0xc850) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r6, &(0x7f0000000340), 0x0, 0x36080, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r6, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000001}, 0x0) r7 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r7, 0x110, 0x3) 7.658587966s ago: executing program 1 (id=4676): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001000000206d0437c500000000000109022400010000980009040400030300010009210010010122070009058103"], 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f00000003c0)={0xffffffffffffffff, &(0x7f00000002c0)='\x00', 0x105100, &(0x7f0000000300)={@_ha_fsid={[0x6, 0x8]}, {0x4, 0xa, 0x7, 0x8000000000000000}}, 0xb, &(0x7f0000000340), &(0x7f0000000380)=0x6}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000000c0)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0022080000002712b0ddbdacb8a99f90241300000080"], 0x0}, 0x0) 7.354573533s ago: executing program 3 (id=4677): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000280)=""/89, 0x0, 0x60000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000001680)) r2 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000300)={0x0, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000000400)=""/198, 0x0, 0xffff1000}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@my=0x1}) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) syz_usb_control_io(r0, 0x0, 0x0) 7.125455196s ago: executing program 2 (id=4680): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) fsopen(&(0x7f0000000580)='overlay\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0x0, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48}) recvfrom(r0, &(0x7f00000002c0)=""/187, 0xbb, 0x2102, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x42, 0x4, 0x348, 0xffffffff, 0x1b8, 0x0, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0xf}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r4, 0x4611, 0x3) ioctl$FBIO_WAITFORVSYNC(r4, 0x40044620, 0x0) dup(0xffffffffffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x10, 0x803, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x90, 0x2c, 0xe27, 0xfffffff9, 0x0, {0x0, 0x0, 0x0, r8, {0xc, 0xc}, {}, {0x5, 0xa}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x60, 0x2, [@TCA_CGROUP_ACT={0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0xbce, 0x1000, 0x20000000, 0x0, 0x10001}}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xf}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x3}]}, {0x4}, {0xc, 0x3f}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0x90}}, 0x20040054) 6.761729462s ago: executing program 0 (id=4682): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000003c0)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff010}, {0x80000006}]}, 0x10) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x10) clock_gettime(0x7, &(0x7f00000000c0)={0x0, 0x0}) mq_timedsend(r1, &(0x7f0000000480)="fb71a659f12c7a10aa515d3260fe8213a7b4351718d372ba480d5f5b43acad9e02eb866a621f1ccfaf243c81b03c2baca1968ff45aa3e4b1381bdf8515a65138f31965344231b1858d9557993fcf4e6441d46128e9489b9c2fca380c5aa89b1ea377b53718b91bf31e0edce6eb23bb1acd4cdfa6eb64e2f95878b64f6673c50a3e8955423f65cb2c667ebac94f5ee7f8540a27e13e6494668c0ecb6a1e876d12ec474dd36caf0a37df6fd3390d6dee9a59f32b1435f6", 0xb6, 0x2, &(0x7f00000001c0)={r2, r3+10000000}) setsockopt$SO_J1939_PROMISC(r1, 0x6b, 0x2, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) readahead(0xffffffffffffffff, 0x800, 0x100000001) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r4, 0x29, 0x36, &(0x7f0000001440)=ANY=[], 0xc0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r4, 0x29, 0x37, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, 0x0) syz_open_dev$evdev(&(0x7f0000000700), 0x0, 0x0) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) io_setup(0x1, &(0x7f0000000040)=0x0) io_submit(r6, 0x1, &(0x7f0000000440)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x8, 0x1, r5, &(0x7f0000000100)="653de841f0", 0x5, 0x8000}]) 6.461631917s ago: executing program 0 (id=4683): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000000000)='./file0\x00', 0x8, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) (async) syz_fuse_handle_req(r0, &(0x7f000000a100)="58785f58471eb4b5b3ff3946acaad41068511507291e72541d949ffc8a54ff637ccef1fe8511899ea7f3c82cbc6539763a34f6760c1608c911801ca672e62708ba4fc023749076ff6a0daba0caa57000acbd9ecf5e97201f7f14e715bc8c089c3d65e92fd65dedb76d61715067ccf6dfec2b56a48f2b274b564d90c3d868f2bdc07b7e636ad78904bca826fa69b7783e7be2b8e7c997b99225467747875695f6d500cb82b479fe9486bb94e06f796f89906bbfccc964830f86986760ade90c3f7a9dde3172a5124c1889075ad30b5ee2a5f257a6ac790a8e89b247ccbc8d241b7b95f8fc649deffc1bc37d51a8c3dfae38ac968eb48695de38df941f9632ef9ad6779e41ccea8a3ff1cac4fa4b47a152a8f9a1bb0094f41580bbf60fa11cfaf2c535a12c866e9414ee9b58226fbdb0d221e1bdc50e3fa300351364f6350030383856f1f809aee19f337f3d3435ae6754916be1eec24643cec1bd1007ffa38418735988cc901603895f66bd6450d54f99e1246ded898499d2a447f899c00368ce1dd4a4f4cf9cdf7d4f8b38d7b98a598ac490f1086ec712b0cb94610abfdb25b0f6947b46e1dd628897ab68445568578049fa6140250a5d821d70f102fadc2fa273a6e486f250712ec847de3b02a121e19775311e8629045f3404bdfa3207aecdac43c3571b86a9423bd716aa67cb688f9ee4f2b14ea42c89f2766c78fd4ec41ab34eebb4256e885bd7e3abe4348772993bb630aa3397084bbc66cdad664d6a9d33767cc375a44dbc0b08931053a6780a796fd31e1d7c512599f9e010883a52c07ec0938ce1acb3fe3baac6af9fb7e9d7942662e41bd3626d240d5ed34ebcbcc0ccf1c3280c76fbf6cdfb04bdb2d3b4ec6a8961b1eb036b211eff6247b95039cc67d222f2ff122340c56d74b4fffa79a202144bb10ad766f1fd6b3276342baf2fdbd26e9563dadd01fce19d7ec025d05d0494e53229379d13c1cae48ec058cff0bc1ccdc94a74b11a9bc87c580bb6a3f45fe15d15d89bf6102dc1085bfe27b2ab462aaf642b8ceed519cf88b31e9e00fdc23e8f6967a72b4c38b2458656dbf26dd75586731bb519a97d0ff43f4358cd40c7ed371ae8a24f46e320d4c4c0a1b8c42f10908a1c283d8032d76f52d4509d78c2f3a0716c37bc0c786ce9174a88d468e88a6d154e4712778aecded0ca5de28e52c04e33672ecea5135438e908aa1bf00e65ba6dacc4bd018b7bb1c30aa5d9acc679220cb5e7207f1759bd7722d10469225aae24973031a21358532a63aab42f33b1f8f40d545fec7799703ba067592b34247fbc7375acdcb3883ace7d34cf33484f2cf662f3f0e18b5c475ae311fb20f6e6b85320b2bc37e56512dc27815b37bfd9f172be1a119197eb53b535c440f97f24724e1d466309c0f8556965bd02d75c3dbe2baa0c6a515db07af1f77306577d0b38f0aa8cb188cf5523368951b8210f4bfc6afa0d058ad84656d27a46faef225e6268396ecb54a5182591bff3a86792db5454e238afe7c26eae85fd3c1c060760d89223bbdbe8966ae2558f47d799839cd959c974b69ad262cf8ab4fee554288e767ede9bc5d7f0cfba05966ef7858e41db363122680abe978345d45e4b52b73fe9f52ad26371a5b0539d88aa0c572aa01a41b079dde5a14e031ad903629d06c8d85ad82828c25a9ba7ce0fef2316eb011643e47feca7d280833f8b3008841fb2d88ea84df65b03aa5baaa29d6234ed5db8db461fc5df77aad38690277cd5dac1ed3c23c9f2778295578561f9a4d31159a826b4b62b2a867e6e8a9514edddaacad22106880e6633fb2f3b17c8d10bec633d6128489f7253b3e3e38e5942743ddd1547dfab27a152549f61891e3a5ad17f733b042f7ef915ad7423b9719fee9142407fe1d10ec8b64a21cd24fd39de4496ca3f394f07149bdbf1393181b5afee090ff40ee31d34a9c6a113e3823fac425fa85e212de1a9f7c4937ba64f3327961fccf85e6fa29be12de9589671d60d4658b1562ce7dedcde8ec79d265c13f5e197b66989c3f067d2801fcd78bb92b45e55fb4089a7cd3b179284af782ae0327ba56fc307a281772384448ee465dccefe41be8d75c8cd0eb5c0217d7ca706848f9b82500b77c2d838cbd536304556af87d3b6fb9183b5dc9cf2d0f7ecbb24d9f790151b9c6092dfb2c14decbe6448362cd7c13515f66a99c37b56134d12e8c7f1a5b75e14e47f84d8658f0b65ea91014e2e4fd361f03dbf8ca509d426ca1bba7e43ce918268393ff16b17d9e1bb49fb2b4f6eeb8b4b226c79303b19412a55b7ea7c8774ccebd8d66abe117a8be9a3c4faea730902136df57aff991b59dd71610ba4c8e1cded8287c21c56526f4fb6c502ea73ae310d56640990b3e695b278de6e1eebd51108cf7547c0e457e5fdf59691baf080dd3f5dc3c9a10bd4cc5e10ba42d4d3d9dc4f7ebe0bd2981a1d6fb06f7457dca1e56fac3f0fa7ca19ec2fb7940ee837e960d93a73bf085eaa2888fe3025aadd33cae85d63273be6ae3a92e35d78602d8e23b9460f04b7c0e0e710d10fdb0dd3fa9b880865603500d81dc7e968e8046569830b526e441f25f8b0af47d524aa80fd7dd9c3f72facec2032e2c06bc33c6b739c5368bf54e32b6acdca9d2d14276a8348ae92bfbd60f6aceecf98f3c6fe70747499b25667a96c52e21236421b27deafbc6b5e2b8a4ea2a0d3cd5ee1a10f3153b529b5c04a1961223a943842e17ee0cd114ce6983536400fc40f3d4708436954803fd60caf2b5ed7e4ce90bc75385e2424191c6a5038fa15d99aade49fa1affe63fb73078a6bb4ee560b0b521aeb33f507bdf876829f4d3f695197468e41503a10870a8e6df800608ac33dfdecc03f64d03fb6180287a684063c7edfc8db1366f6bb502fe446085f6acc4741b273a0b736f0f55da28967390bc7434db54ad0da9d1d002ceaa5c3e53efa95e7aaa792db32501a072e669da29fb734d771a6fa8c753fb2fcc204e31d668992473e7937fcf751bc79b125db1725f2a495bd2a4207e4db8d44810a4db5113705c5cb8733866ade3375d1bdbcb965cbd927e7d285f2933bf037911959088b64cfac0ff1e39244f2e9416653ed87ec564eb686af1062354a8bd7034c1022cb0d0b6996762ef4a0a3ab4f3deb459f023a867a38fcad2a10fcf0872862b386ff7c5ea7ce13abb112d1f0ed0723870eccc76d16f7e3cc00e28945bb93d9f2bd8e2017993102f0824867ec141f20df951202a2ab1cd796516ca0b4fdd9e6de8b82fcd30f9ab85cf0a5547e1ad1ef1ad5be7a878a16864d7c06b4ae002f3ba485a9bb36b8a591ecb64a4a5c0fd3b4beb015f58ea4cfe190f3b46cc4d9108d10c52a9de859814edac575d2a3d937a9b31db049e70aa76c085ab63d61c1317205c228f7027fa39125de8fec40ed7982e36a7cfa9fedca30f0b692bd4c7794f6b56d69ada1fed168cf03cc57321fe37e3a8cea4bd093e87b657fe5acb13d2591bebb526301d16707eaa38e52f913f8aa3e27b2387ca1a217ac69966e287ad5cb0286535d5d00b7006661dbc7923a066945c1a2040a4e95d7b0de4dc8217bf1d4e9b6cccc671fdd9a5770c21e749b407df8c463a3bf17e47bfcba6a890a0435d3fbb7252fe072b149b7bfeb185b088686dd70e0c9cda275497b553aff2b319f7d7b0ed64002c5f9f6ccfc3d55d8c908d314487452f37a650f4561326a84c660b6111702a87db03595b5d080c60288203f091de9f78b997e47233f4bab9b044a98ab118a6c45b7ca746cc2fb90182a923d67216412e24a955c0c2307acc47bdd319955249d8412a5ccf444437f53f524c69ba0167c920f0c1f775cd1a225636200a9e4adf61f418d20f717339d0c8c5386af0936f628cc589a8d5581c1c8cad0b564a3f38b606473280a3fa586a5ba932fd38eeb23096df29a92ab54c409f88ef4f03217f0bb90fea539e629d8a025c802f6b5c3d735fe950c8ff7136e6db287851dfbffea1ef81491a50cb75a103367e85afa3484d6af865dfbca91dc05632b0d94aa384ee0c585424a5ddf80babe0b913b0a2eedda34c7ea7814642a69f8eae868274b16fe0f52fb60b201e6685dad3f419413d5b8186992855a25ffe0d4773a14c7977181a120cbc42af4f9acca3fee1d54ccc125ea49b62ab60c58a0ecdf50ee7c16f3b6b12b254fc08fcc85d409eef7c3f30cf705617f926a17e6588a9fd7e34be9fd863a7b157a2d9a336356d568c2d2dbaf76c2d2b2ff8703748b860e36f02b04d6e4f2fd49511f12ce395dc18622cd51948a32cc432cd797d8a68838cebbbdd9bcb6f2e85719785706012e894cb043bb9a53998131fd4aae3321d81fc001e718c4a99c0580af1d4a0c81665cc5adcf337c8bc00fc0fb3c7be0d5e5ff6a6fae5891858eafedbed69223170ccc71ce36ae439d769c3520972601fbab93f54808d6950cb7cf1e5a3b32d8c6a975e3adccca0b2ee28a4eb5ca3b0ceb9d31a8f767c3f4486a62215171738007675a55abf5916513f7eb9b21ff291f2b4b48bbfcf394cf861fe016b3680be422a8bff49963ce096d1bc17186822b1392e68b1a05fa6c70bd2d9a164f12301a6e78caa8f4cd437497320d383e752dd224aeef80794d3f206741363e74fa181c9f1dc47557553de620794f096c59ccd74a178f5adb466ad5a62fffc1886f56ebceca4ed46ed2396bcbc31160b4eb1b7d69642e33315e3adbdbe1b9794931e7babf745ecfca37dd4190013793d530df12d6521bc069a05a94e0ffe91900a0c2209a6914d2f85bd161ff77284198129a9b1ba600bda3e52769d39c1bd61c4a70c627c3ad89aa0bdf0c93a2c35e166da9a08b4d2f92deacb6e9034274305b6d254c4052868ba32bec9aa3cec75debe24e78e43374efffe444722a983935f9007fe3de37dd83c52be16e034d09592a179275dd0c91281be579cd19c0162123886893713f25cdae19cf258926bf2070741111eee6b3df708c3fc416b7d046c948bf8500779c0cd5460e640bb1f860f58052b8087e6eb2f16e48f4984c9f9fc9fb2652ac5305861ece5362db08ae912ba055af766da1322057d0bfa647d98b8d4f1e7ed43ecdf1050c0eb19dae93b8014da57241cdab4ffacf0ec1348d4a89b3e8ff187098d83d8eba34e5c7ad4215f1977968a9d337d08fd1188754e7cf41baf0189ccaa5f3b1005f807b0255ce1920ca7d919e4684af70c3d089a99922727c607a2b06e713dd61122842a913036f6cd64dfb313fbdf639fcbd712852bb85337d056685b0a54225ae27e1e8c7ce5acd1f017b8f712c268b9cc0ee26d26c63f0a8b0a40fccec5f945431a2e81c35720d178feb481092e4f51978493c5fd502f252bc0152f145f268ead14932990069169483ecc7abc901657460c8730715c078b61059bd2621f50fb838376e0b808a3f118f761efea45bbac4274016960063cc67c428e72e516685552dc3bf473e442d76f2d3ed07b319694490054302a538b52e3b8496b7e37fbf4a2ffff2b484f98fdb14c66ecb8447834733f8a7a5a3c83de34b6647842dd56d8201f9d9240f3b3a5b5cbccf174a08853d06fd164fe74e04608ae12df8a35b73517d22a87c7ebca60942932d03102ff7e8644611b5520b5ebce950945498ce19210c866e48284d18fb7e049deaa43ee5283e3dfad7316ba85490e93182d13efe7ba64ee5ceeaabcff3eb24d46a3a129dd5a6b82e8c48210cb1e6564833f3e15dda4dec383b4319741cebf6374cf2c5d64722afccf7c4e2d81ae28d45f2c35b764281f1f08fec8f8e9277277ae1ae8a8981f85e041d2450afc9374e978f73b66da9aadb2087223f28e21e946eb07710ec86cdcad0948d4ca93827ea34e28806d172c3feb83471ed2d4d7ada2360b209d16b9d35861082d85b6be3c3589a6bdaf6f9b5d52ac8fd7388e32b24f1d5d34b5442c1ceebde311decd709f075d064f07bc60ab14c101ef51039eed56ae1e0a374e3e956603737b3a16db684a81e9b8998a0bb9b17a0876a92b2a3b9924f44b16ae4c7ff376ea8a8c91b504c1dbeb522cf846fc3ec6b9a01f452eeb35cade34c6a0463b92c46e013ee7906ee934141870ddd1464ae688805933504a2dc7cb1f947e28bf22f5eea6afb5de3b950056bf44065b84fd5589385d0feec4ef1db4fb4b595957130e575dc383e3686f4674143debb23e17b398f32683fb4805f297369d0e5f2e63af6891491e4e37186b4a3dffbbdcfff63d1fea4e12d24ef96fde3ed7a323a3605cdf5eaa43da738004556c2c20aa30c40079bc2e9ebe102c1fcf5259f1e3acc6b2a2bc9da4d0b1252433c58a1810581152a235e93deabf7f728eace350bcc4db4f249d4234bbd858c4e61a0eda4e3db0ae530c78eb63425502d651fd0cb986341ba69c44ede18eb3ebf25b2336cdda02447a9e20426d8206368c63b5fd6828612d3b99f627e331bab0009579de8270c36aa03861c300d34f2a3703870712325190073e6c17d8699f6744acb1b5468f93b57ab0366796181a4f543511d7ea2b32606c33cda61e81ed1c2194d305be47a3f1a9145d023620af12e79ec188573526ec35b9ce44e95fdb3530bd0431dd12a227d0ffe317cda1bbd787979261d6c9cf728b3d6bec3ba6ae15a595a30fc242bc5f25d837c1c642219afcfe043bb68a82965574b8b2139789235b262cf4af95a538e6954acf8e27ac3c95328df6e4bd615a376cd96bbc9e0d9802fbb40f80a848225e076219e26e0e63f57330b8bda69ec8dbd8b3272798cbfbb085b1885a1c22b3e2df2a879020ac1110b7af4f53ac97f556596ba0e164df0c85842026a87cf9631c9c9d851549efd8ca37e3b863e88436d5da5f4d3b5b5528e2d08d92b0d3ac6a06a0699653718e93a25b5afe254a068e300751eb6c67e3f5a1813d58d428f1ec108b88ec81444ccb50e8452941510c11f2e80bfd712f64b32b686c92ce922baf6c8eed1e9f0717a654d53b3ce1001880de80b5b15362b20286db9dfdf6c41f48aae84d5ab12ac45310f0eefc56e54113bcf95c1b2a259895af2ae9c679de4e2b898bf8a40a199a2059f8248c1303351dca3fb38906a682f66a94ee660debd6eaaee7b2f1051781084b3c9d626263d011a3daf971b708750a77614753b89b5e1a77a52510ced5708083fb48c554dfd6aacfcf97650f3a3b3f97566050e76da968d4eceb83bc1e005ed1596d6e0ec5e2c90231e62496d7435ec5b28f805e3b7aefdd3718e4ff53065b8e4b15175d80eec59218d8278e711c6049bf6d62ae7069578e957135463d7616b37c1e4bf44d60dac6c7aa04cbbc4a64bb0cc0b059abb6b26f8ed5203232ddd8a6c5882e6e6c53068a71bc84c5834104e85bc96db2163798a3881929248b8c788e5bdc9e46e5f7f3f6ad43fad6fa381a0b924bd938702470b330fb90ba73d557c0d203d55edaed6e3a01aeb53b061dad57713ab27e1a9e0d06b534a65d85beb061bb5258bbb38179ea612a6f402affb8ca018ebf0d6f61d44d5a657c080c7d2dbc9b08c07713b17b0f173ada59b57abb401212f4f1fa026491b48d08cf46a704ab43e46de8ea596d68658523b61a156278b3b77bd1f4491381bfd874ed72b00675fd5b4b7c0ec13c6837434ba8e22230d32e7bb1287e488e14f5c5602cd4ca88012b244c7f23f4897e27027aa862ca139bc8b5fe14be7554832ab02e4ba19699a1e66825d94c7c44451062819a38d3376f0a3716b210c7adf4bfbbc303058aa2e054b3bd53539764f177b11b05451705550f90196997de3d1d480e500cd9d234078cb1a09c63d8911381d327402702c2765fe92b8ba3a0189b2b11b7460996c36eaae3ecb4f4e63bfafd7953ff086dfc0b12e616bbdca4707631467b830d244bd3f4371744bc8a4baac728a397818875d1b6a4a2f0d10be607122a6fe813f52e4456b8a5eb6c9ee0cf889f777a03cc26a055f9f259cfc4f8552b568a4b371260af062619dfb215ecfe7b318f8d627d2777bd5103d6ca2948d19d5812112962b63c2bf3d090ff19185dbc5ad49a580451de717c0baa288cd96669babe88a8b1ab6d0936c4c407878786695f46f59ef06c5c2166b661542c598b6e0551d490946182841184a7a0e669c6ccd73a342f65c4525dc7522dccab15fa72bd07588b5bca71635b9466ca72a504c74cca1c573e8d40d83d1b5c5326481ff8a2055a2e0fb997fe8e4787deaa2a8a57afe74a971e7f1f280895f2fc9d99c41416adef7b70ec47e7a12d0ca3c0ab1dba3c2d65bb172fde1fcd7f97692d3d8c9657e3277ce95947d59bf37dde3f35f7a5d76575f5c14caf7f0926c0896995a5f42efd0d38c42de202bea5b5db39bf697f9a96b54aefec723db523893186634763e7399bfa8029c2708dc817984528601c77a1d78bd4b2c85f10f5ca9363badcdab51a1b315cafa5c2ef64f60395f53efb9d60d89e1b2a5f147508c90d2b09476eee3cb9b5957669a77cd2c522909480dea9be3406d1779ffe4539f2e03efb5f8c2d040f0ea776ff869a36862246294d0ced556a129ef78327617052dc1ef5cfb4e5986ba2f0e063b90e1657d8977b58827a3c4e3d556eb3cf0540685f7c9eda461aa2ecc539fec3d2d56be99a518f11752f2be2f670c5fbe8010ac4eae0ede31c1a48f747ff2eac9fc069d3700a40bf5fcda80a3a4f5fa920f117a72de6da51195d2d7f0cc92ff7835bce2ba6b564832f582df56b24cf30c8297a826a4bbfe0afeb1da3e986b3d0a95509e0037d212a70178ecb246061e067238ea9238e4c4a9a7c6fc5dcba290970f50c52598423336c523f2de7580d059fb53934cb0beb208585e897fafeba30853e54badefa197478fe6b9f26ed0d33babb53acee7b7221d8e0cad7a6bd0d9383ced6391bf88ca7aa50c75c136075e87b92445f02fbbc92f7cb65fe2bbe0bf0c9fc2577da63a56f1efbeb276c1f4d01da6f6f7a842212d96dd45edcd2aee7f2c553ace15eb9336bb1804ec252998c5c8b25033894b05c01ce7c77b73ec0e239478c67d5378fe5a53fe6269025d54006e9bb1cbd09b81a39615517c609f3d74e377888f641587121f0f097b48d8be85800295ebab9407978a9cd379966577cb6e1f5261e4305696a2cdd50d8cb1964d3ae18ec730d40f9c782533efba47db8378c6aa15ce85985e211fff2659729599802a7b585cbef3a2762595f67e2054a0fb4457b146e7a656abb2c4b2387d760f7e5b8b7864132317d5ba29a662f50af8dc182d2fbe216db8e997ac856bc59855ca48999699cd6c5576cc47bf8a8c30638c7e08847e5083aa82068940409461d1065c2b53292d3ab145d5bb590bcd278e48ebd34920b18a2e1731c1855ae5a3ed637ff568d205a08cf98c58f5d79c99912e6c1ab257ece0d68ef13d69a56364419aac7df43f43d5faa9ad851c9810648f9050012e55475109ca3ada3452b78a7964377e0d862e022c73ca3ed6cee8c5fbb2d7c12f91c4851fea7c5b02e0a3c5364b7fcca110f20f8858465c498d7e9c6049417fc5c7d4e0059852a6d794af426e938a401cf43b2ba9f4f3f6f0f2eb710ecf3c0c36c4b3072597f805eca9cb14602292ec7d5601e6b1555c8d024aa4bb81a4cff98cb03725cb184ea7dbed6814106a1402bf68a2e51660af930a500d5530651a0dbf2fdc01a31a99be25350b5c8a5fe01155343d028c03e09009ef2c386a24eba8d842cac581402c8faec7dca1623afe25a230d8d4a8bd23df3cf12abedc2a50e387285acf1b3105011a2bdefb204a53b20be213b50f5244511f25852271e05c03fb9a799ac7ea675ffbde8de181368748a9707674e7e70f28a75e4036b6cf9e0693f91a65be4478b6630067ad8dae030a4b7b9784a206b2f7cfeeefc65aae11fc20190f4d6387bab05fa6de640bfbfb0c4f604878771aeace0676d12325e61b19a5317c4d4bb9fe6f3fc8b171f1116528b7cbcc4a91c26a729b512196828075f4d0aeac98887e2a6a19b4e1f1f66233962961c0d49df14c3e6123c9ec8dd7152ad045000107365fd5ed7ce6a6d65ae0736a7e227f77c9b0903d4589ac58ceb691583cdb93ae3fc792c886663cb7c5b0640deb66e29b3c69d2f1a3d1d47d7b672ee3c49e90bd406aa84a0189808924c4e67c5495b045e779c58ca65b42889f52d7315c66be3716dc8592b4875629cd0cb02c29d42bdf9ca5c16bc9051c2a6c09d0695bfba58c19a995838c022e9936c407d8999aa65e4a9d6d8eff99f8dcfac9b561375b6d1293441b9d32533161062c053c63ef09f6100cd748700a710f5bfc2a6297b15242b1f41e21bd004b885d6429a0d334a8c115f7d53d278dad24c9d295b97c50eb340d1e6d523f1757e2014c1605c3bd35f0cfdb74f79850423a37e2f95dfe41c56df09724d21065377f1818311f0c70aaf6fb2d4fc8d9eef576136617371d85481770ce9c390859eacfebba34e75a238ce80bcccadd6c42e8e186be3c15451131fbe9e345c05ab8e23f917d269686a9b5f06dd474f95757b9e5a3328416595539cbdfa69efa9702e5a268b1a70c6e5ff2c118a6e574bfecf17b1576e4f2f7ee566b0b2b5388476a68562991ac01412fa463b0f9e586ad4bde59e91a4b303268b5d8644cb7996cfbba422facd59875ed6ac057e563412255c412be0928a0b6fdb6f35d7008b5d5528ca796a4a69bd90b993a52da9c7d62f4b71a2763f822bb39f3ed39cc5ad5a4d51b5c27d31d105000f3f1e705ed5c42067106f3fe6d30151021bcab7f3a1ad9175b3d3644325aa676b9e057bf9d9aa3348b1d9b31bd639c59bb63f46a6c18794ae006db3b1ee20368160a82e26aee5a9fdc6b44df8be294f3ac0a1275e57ebf5e384b141ce89dd51aaf2248274468894645ba54bc4e6b9788b1eb5043c1f0dffe2e13c6179d0238d8cd037b6fe3e484445ab458fa09e4e8010d3288aa6e6cdbfba4b62c7984d058da8993d5de1df75a1ce8e3bd5875709fd2ede4cd5843e7102ed4031ed096a0c6e3ae9d522ad95ef4af83599507dd32fe3325819cdd7718c9797e921e6e365175e1dd53991edcd2baf27df8b1670d01967e97b3e3e75d297f908deedf2e3b91bd61973e8aa75a5a6f9db11525dd35556bbd13873602a320af74677832f93bd01f1e0631c882c8ab254a26b73a60a6c90cf9b96bd576e05b9befbce882c5d29198451bd15acaa894a5276ea9d870f49a33ee9d2429ef35a905b281deb75be54fa0c9e47be5876d7dce01986f2d0e7ae6df9b87a0ba6cfa55cec0c65dd386db5adc427eac18a00c9aded475417add4ebb8880ef3dd218a9ec3e6e13456f8de1630774e918fe5288dbaec3dd2a74698ec9e28ad573761b9e78af3d5c7a61e3eefc1a54c25bb841529b3fc9137836a2e7eff5ffae8e44f0257160da51ec0b3d144b92f1f43d2782513705baf5930903602d40cb4de87feca7243d2248a78a5d684e303ae147acc96e0b755eea77092b5f6efa723afc6c9a44c575738725815a9af1ced500", 0x2000, &(0x7f0000000200)={&(0x7f0000000400)={0x50, 0x0, 0x100000001, {0x7, 0x28, 0x7a, 0x2143040, 0x4, 0x9, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0xfffffffd}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) getxattr(&(0x7f0000005140)='./file0\x00', &(0x7f00000000c0)=@known='system.posix_acl_default\x00', 0x0, 0x0) (async) syz_usb_connect$uac1(0x3, 0x94, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902820003010000000904000000010100000a24010000000201020c24020000000000000000000904010000010200000904010101010200000724010000000009050109000000000007250101000000090402000001020000090402010101ff0f00092402020000000000072401000001100905"], 0x0) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0) (async) timer_create(0xfffffffffffffffc, 0x0, 0x0) (async) r1 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00') pread64(r1, &(0x7f0000000480)=""/262, 0x106, 0x36) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) (async) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r2, 0x890c, &(0x7f0000000840)={0x0, {0x2, 0x4e20, @empty}, {0x2, 0x8044, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e2f, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}) (async) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f00000000c0)=0x2) 6.306430333s ago: executing program 0 (id=4684): socket$kcm(0xa, 0x2, 0x88) r0 = socket$inet(0x2, 0x4, 0x5) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) socket$kcm(0xa, 0x3, 0x3a) r1 = socket(0x40000000015, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$packet_int(r1, 0x107, 0x7, 0x0, 0x0) unshare(0x8000000) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8882, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000100)) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r7 = dup3(r6, r5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000003c0)={0x1c, 0x0, &(0x7f0000000380)=[@acquire, @increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x28, 0x0, &(0x7f0000000340)=[@increfs_done={0x40106308, 0x2}, @register_looper, @free_buffer, @enter_looper], 0x0, 0x0, 0x0}) writev(r4, &(0x7f0000000240)=[{&(0x7f0000000640)="d88b22e41c79469fbcbedde69e7ded43dc0389445bb1a925030d2356cdcefda6b69bcb58c912cdef599ea062050fd4ddb7999042299655e268352be255b6fc669d9826765d7e73932db14b068ca17ca90e5693cd97ae7f2dab19a2c33d2b72992a9abba241d5cb54f4a0c50957c19466878a3f22d350acde589e37f44af202c091c7a72a96367b2f3b86cba81290091881d23bdb69884dc40106bde3704e717fb734ec98f8233c2708f9cc67978c437133b66d029ebd0e8589b7c33945a230050c16", 0xc2}, {&(0x7f0000000440)="3adacb9cb7f36576a1e2a49234dcab4b87ff25a91089bda69ac3515bc6ec1809cf3a3a9b9f97013933566753480886f9f101ccd6e3b42fe042ce9a1c5888929d3eb6bb793666860d61bf00f5265b35daecbc2837e037da9976123b10c7a7ccf361e7fca584a18dd05d6b99b6604351c4ceab6536bbbf91a4ebe02601dae2bb11d5ac282fbd584a82743d50b6cd238a641fb2173b5ce2811371663de96bffff647baf68ae6e946246d8848755e5045ceb7f80808b04a4d245e7b0d65108777a2981218e28da51a6cf", 0xc8}], 0x2) r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r8, 0xc008561c, &(0x7f0000000040)={0xf0f024}) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000540)={0x2, @pix={0xffff, 0x7fffffff, 0x38414261, 0x2, 0xd257, 0xfffffffb, 0x3, 0x0, 0x1, 0x6, 0x1, 0x2}}) 5.713063771s ago: executing program 1 (id=4686): socket$kcm(0xa, 0x2, 0x88) r0 = socket$inet(0x2, 0x4, 0x5) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) socket$kcm(0xa, 0x3, 0x3a) r1 = socket(0x40000000015, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$packet_int(r1, 0x107, 0x7, 0x0, 0x0) unshare(0x8000000) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8882, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000100)) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r7 = dup3(r6, r5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1000, 0x2}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x28, 0x0, &(0x7f0000000340)=[@increfs_done={0x40106308, 0x2}, @register_looper, @free_buffer, @enter_looper], 0x0, 0x0, 0x0}) writev(r4, &(0x7f0000000240)=[{&(0x7f0000000640)="d88b22e41c79469fbcbedde69e7ded43dc0389445bb1a925030d2356cdcefda6b69bcb58c912cdef599ea062050fd4ddb7999042299655e268352be255b6fc669d9826765d7e73932db14b068ca17ca90e5693cd97ae7f2dab19a2c33d2b72992a9abba241d5cb54f4a0c50957c19466878a3f22d350acde589e37f44af202c091c7a72a96367b2f3b86cba81290091881d23bdb69884dc40106bde3704e717fb734ec98f8233c2708f9cc67978c437133b66d029ebd0e8589b7c33945a230050c16", 0xc2}, {&(0x7f0000000440)="3adacb9cb7f36576a1e2a49234dcab4b87ff25a91089bda69ac3515bc6ec1809cf3a3a9b9f97013933566753480886f9f101ccd6e3b42fe042ce9a1c5888929d3eb6bb793666860d61bf00f5265b35daecbc2837e037da9976123b10c7a7ccf361e7fca584a18dd05d6b99b6604351c4ceab6536bbbf91a4ebe02601dae2bb11d5ac282fbd584a82743d50b6cd238a641fb2173b5ce2811371663de96bffff647baf68ae6e946246d8848755e5045ceb7f80808b04a4d245e7b0d65108777a2981218e28da51a6cf", 0xc8}], 0x2) r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r8, 0xc008561c, &(0x7f0000000040)={0xf0f024}) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000540)={0x2, @pix={0xffff, 0x7fffffff, 0x38414261, 0x2, 0xd257, 0xfffffffb, 0x3, 0x0, 0x1, 0x6, 0x1, 0x2}}) 5.155104227s ago: executing program 3 (id=4687): r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000480), 0xa400, 0x0) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x7) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f00000004c0)=0x7) fsetxattr$security_capability(r0, &(0x7f0000000500), &(0x7f0000000540)=@v1={0x1000000, [{0x1ff, 0x4}]}, 0xc, 0x1) syz_io_uring_setup(0x7758, &(0x7f0000000580)={0x0, 0x929b, 0x400, 0x0, 0x33c, 0x0, r0}, &(0x7f0000000600)=0x0, &(0x7f0000000640)) syz_io_uring_setup(0x51bd, &(0x7f0000000680)={0x0, 0x9087, 0x10000, 0x3, 0x38f, 0x0, r0}, &(0x7f0000000700), &(0x7f0000000740)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000780)=@IORING_OP_WRITE_FIXED={0x5, 0x40, 0x6000, @fd=r0, 0x6, 0x7b, 0x69b8, 0x8, 0x1, {0x1, r3}}) clock_gettime(0x0, &(0x7f00000007c0)={0x0, 0x0}) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000840)=@userptr={0x7fff, 0xa, 0x4, 0x400, 0x4, {r4, r5/1000+60000}, {0x3, 0x0, 0x6, 0x57, 0x2, 0x5, "367847ff"}, 0x6, 0x2, {&(0x7f0000000800)}, 0x4, 0x0, r0}) sendto$inet(r0, &(0x7f00000008c0)="f93caf98dc12f64a3a926e3d7101da35fce79b7311d01a0db50e9ad96ffb206e1db47c3ff5281f58ef53be6a81276257523cd9cbf1a5c7294d0de100d798560e7220fd625abe94b36d21788c271186a70ef3", 0x52, 0x40090, &(0x7f0000000940)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, &(0x7f00000009c0)) bpf$MAP_CREATE(0x0, &(0x7f00000032c0)=@bloom_filter={0x1e, 0x18, 0x9, 0x8, 0x51c14, r0, 0x8, '\x00', 0x0, r0, 0x4, 0x1, 0x0, 0xf}, 0x50) 5.012250296s ago: executing program 3 (id=4688): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x200000, 0x0, 0xb49, 0x6, 0xc, 0x0, 0x1}, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) shmat(0xffffffffffffffff, &(0x7f0000ffc000/0x3000)=nil, 0x2000) ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS64(r2, 0x80044100, &(0x7f0000001a80)) pwritev(0xffffffffffffffff, 0x0, 0x0, 0xe, 0x200004) prctl$PR_MCE_KILL(0x29, 0x1, 0x2) r3 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') lseek(r3, 0x1000000, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000580)="1400000016004163d25a80648c2594f91724fc60", 0x14}], 0x1}, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) setpriority(0x0, 0xffffffffffffffff, 0x6) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c00001400028006001300"], 0x44}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) pipe2(&(0x7f0000000040), 0x8000) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4000000) 5.010921922s ago: executing program 2 (id=4689): r0 = getpid() sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) pipe(&(0x7f0000000140)={0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) splice(r1, 0x0, r2, 0x0, 0x4ffe2, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) r6 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETCRTC(r6, 0xc06864a1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB(r5, 0xc01c64ad, &(0x7f0000000040)={r7}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06464ce, &(0x7f0000000440)={r7, 0xdf, 0x20007, 0x6, 0x1, [], [0x7, 0x7, 0x2, 0x3], [0x1, 0x4, 0x6, 0x3abb], [0x7, 0x7, 0x3, 0x2]}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f00000001c0)={r7, 0xff7fffff, 0x1ff, 0x9, 0x3, [], [0x40000c0, 0xe8, 0x7, 0x19], [0x8, 0xa2d, 0x53cc, 0x35], [0x6, 0x8, 0x7, 0x7fff]}) close(0x3) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r2, &(0x7f0000000000)={r3, 0xffffffffffffffff, 0x9}) 4.909613497s ago: executing program 2 (id=4690): syz_io_uring_setup(0x118d7, &(0x7f0000000040)={0x0, 0xe47a, 0x80, 0x1, 0x25a}, 0x0, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)}], 0x1) ptrace(0x10, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$vcsa(&(0x7f00000000c0), 0x1ff, 0x2a8102) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) ioctl$sock_inet6_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001040)) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x195180, 0x14) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x7f, 0x0, 0xc, 0xffffffffffffffff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$KDFONTOP_SET(r5, 0x4b72, &(0x7f0000001480)={0x0, 0x0, 0x11, 0x3, 0x1a6, &(0x7f0000001080)="0324c9a460c694a6e147b0b6679f6bca9e563d900af1c7f6fc2f67d2cae50d1c800fe8672eb4642eaff260771296fcd949ac138c1b6f90f733b2e1cd524cf98d83fe2366a834d966382041d40fc0869c6d729768cfcbd2bda71b5452213a0975b305226a5495b862fd845c3b433d6f7019bac7f138888f892317f3439c98679309a459ef457cb32572801b2c52e9b8805ebc67d3c34af0eff33f9bb1043902942bc5bc37d1c44f7f77e0449bd22b425646c2a59aba111b6bef13a92f1f62f9b87717b061122b769c91f3c08097119eb74ae3b14dd949aefbc817420b7da0ab05f3cefc937261aec6977eed70e4b216968139f1f58fa7b757f6259a7183bcf8b38b8fb5d9c7924cf32d695bf3fee463cb56ebaedacd7b370ec535a8930f646efba69d73b26fb080357b0289a4b92c03c7c9d444390733b8cb3212fcda3df10a26dec4db09736178d43eb27d0b533ca53f490b1c9e368e93e30c0081691d547a5137a9c6653e2e65cc3f264b2cea527cdc5c3e340ffeba54e64b52eb872f4f646d464b28c387cf5e6657a5948ccded1e3ff7a17f599d7cbfdf28fb7566a1b3a41762e53eee33546d2d8e30281b2db5afcb13bf62160d03204167b774af4b60beec7dff823067b7fb048453ccb9b7c3d2f3c92418a00874bc7e01e2941fae2a599decc46188962950d5ac1fecc907361d7a276068fdf6a288675646f80ec329809b281fa0afe8ac750c5e04c65ae8729c940fb0b354cffbae9ca50ff1ff472b094420293eecd5a05d8a0cef3d38febb5cd42f1208aafd033468f2492e88ccc05f585a4182bb04391b88c85d69613af261059583f23726000f248d872092d9df83a86413af7c64ca34752bbcb7e908891e18a77439d056062461fca6f81611f86efcec45a563c363e803d8abcafd1d2c29ad195ad7433217c791193872e6d9c77aa23d1b07278e77e3f8ff6acf852728501189fa4e0dba05121448e3834a55372a62d0352ab6acc6651ec6c4f2b8ecbad1d8a744f0bbb9f7411e1c779768521e56db9723145e1dbc9a2ffe1c0ee70966abb75a539825d28618441547d0f1020acb4940e39739c14522ff479be1cb390580c75dceb95bc10417651f0833e5bce22b14acc011c67f4598409066908810e6e35427d2761736839b25a14efabbd9aac04fa22ca57a0babc9cce7e0ba123be257e1914c371263bc9011ae62cfec1e33a6ec954b5cbaca72f33c8de97a1e773caada9412ee7cf79bd8f9aad350c64d7684c5b61a26a981d73ba063854bb14314bf38d0307fad977c2e1a16d48607ef28520771f5644aa4aaec05449744c5237e06c4ad59b93eb5225aeff881d3ecd9a17987bb505f8c3b1fd2513a940f6d9cd11387a00445297100acb071b14b210750281723d007778a185e98c3b0046555715e4e7d167cb1dbdd9bc22a7383b09bad7e0d"}) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x2b80, 0x0) ioctl$TCXONC(r6, 0x540a, 0x3) writev(r6, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x47, 0x0, 0x1, 0x0, 0x0, 0x8000000}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) sendmsg$NFT_BATCH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014", @ANYRES16=r4, @ANYBLOB="20e47938cea7d53031d15b67ad5d6b2f83257f840854da52a0da4a2fe69dfe3518005cab84c0cee15edda8794fcd63df0a9d99f76c9320d6145b925c8070ba768e5cf7784e43dfeb147e1db64cc13a54576a87f403f6a2ea1e2a4a919c624286e0c680dae93716f786e0316f5fa4b76774e4213ce8e45a2d7b2f82fd93da8780"], 0xfc}}, 0x20000000) write$tun(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="0800080006000600000014000000450a0fc0006600000b2f"], 0xfce) ioctl$TIOCSERGETLSR(r6, 0x5459, &(0x7f0000000080)) 4.4246935s ago: executing program 1 (id=4691): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x4, 0xfffffe0000000001, 0xfa14, 0xffffffff}, 0x0) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x0, 0x4}, 0x8) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x101800, 0x0) r3 = memfd_create(&(0x7f0000000840)='\x01\x00\x00\x00\x00\x00\x00\x00\xd64\xf9 \x00\x00\x00\x00\x00\x12\x1a\'<\xf5\xbeV\x12\xaal\xfa\xf0o\xd8\xb1,\xbd>M\xe3\x98?\xd9\x96\xab\xc7\x06F\x9b\xab\xc8\x1e\x89]\x13bZ\x8d /#k\x95\x9eLV(\x8a\x0e\x93\x93Vc]mP\xbativ\xce\xa4K\xfb\xf2\xe0\xbf\x9d\x82\xa2\xcd\xb39\xb4\x17a9\x1c\x82\x1aLT\xd0\xb9\x1a\xafB\x95\xb4\xcf\x91X\x8c\x87\xc2\xa1\x1b\xfe\xe7\xbc\xf7\xeb\xc0L\x1d\x98Zq\xce\xd3\xefB\xd4\xee\xb5\xee\xe0\xaa\xdd\x00\xb1j$S\xfc\xb1[N\x8d\xcfI\xc8\x91\x87\x1fuYG7}%)\xb9\x00\x00\x00\x00\x00\x00\x00\x80W\xe0I\x0e\xa4\x1e}\x06\vK\xed\x11\x880\x0e\x9c\xaeVU\x88\xb0\x842kgA]^\x88\xecif\xee\xba\x8b\xc6\"\xcej\x84\x06\x8a\x99\x80\xd7\xcf\x96\xed\x89\x1e6\x93+\xec#\x1f2\xee\xce\x17\x89\xa6r\xc5j\xec\x1b\xaa\x996\x14e\xcf\x8axQ\x9e\x035\x8a@\xd4\x1c\xe0\xa2\xc8\xb3c\t\xe8\x1a\x89\xecL\xcf\xd8\xb5\xfb\xbc\tX\x88\xbe\xf4@[\xb2\xd5\x8c\xb9\x0e\x17\x8b\xce\xd09\xd2\xfb\x9e\xef\xabR\x88\x17\x9et\xf7\x9c\x01\x91\x00\x00\xdb\xf9\xcb\x7fh\x83>\x8e\xe1=\xedR\xc9\xe68h\x19\xafLD\x94\x93\xebT\x15\x817\x9d\xf5s\x03\x1a=\xcc\xd1\xa7\'\xa0\xaf\xf7\xec\xaf}\x0e\a\x00\x91U\xf9\x8e_f\x8e\x00\xc3r*\xc7\xaf\xe2\'\xe0f9\xde\n,\x8c8Y26\xa6u<\xca@H\xdc\xf1\xb0\xb8\x9f\xc2o\x0f\x02I\xb6\xc3xH\xc3\x88(\xb6\x97~\xea)\'\xa3:\x8d\xebc>z\xae*\xc2\x14\xe9\x89#\xe2)\x9a\xb0hR\xffa\xf8\xde\xf7q4\xcfV\xbb\xc3t\xfa\xa9\x05>\xaea\x12\xce\x1cY\a\xb16\xb9\x12v\x1dN\xe1,_3\xa9\xa36\xaa.Cj\xd4\ah\x92j\x86\xe1\x1f\xec1\xb9!lI\xc7\xbf\x85\xdd\x03\xbd\xeb\xec\xf9\xf3\xaf\xe02AzX\x9aO\x93y;\xa7,\xbb\x11\xe6\x8fn\xa0m\xf8\xcf\x92\x19\xba,\x0e\x04\xbe\xbb\xdd\x00\xb1\xb6Enr\x17\xa4\xc5)\xcc}*yN\xdc\xc3\xe0\xf2\x10\xe00xffffffffffffffff}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x2, 0x4, 0x4, 0x9}, 0x50) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0xd, 0x9, 0x4, 0x1, 0x0, r6, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x17, &(0x7f0000000800)=ANY=[@ANYBLOB="1800"/15, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r7, 0xffffffffffffffff}, &(0x7f0000000840), &(0x7f0000000880)=r6}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r8, &(0x7f0000000d40), 0x0}, 0x20) ioctl$sock_SIOCETHTOOL(r5, 0x89f6, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0x25, "2a161d2d7137f20a8f1597f02515fcead4e153309c703be3a0d6416f3528fe1da7e47629e5"}}) socket$nl_route(0x10, 0x3, 0x0) 4.284719158s ago: executing program 4 (id=4693): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) 3.99876883s ago: executing program 0 (id=4694): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000780)=0xc) r1 = gettid() timer_create(0x7, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) syz_open_procfs(r0, &(0x7f00000000c0)='net/ip6_tables_names\x00') sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000540)={@multicast1, @private, 0x0}, &(0x7f0000000640)=0xc) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x8970, &(0x7f0000000680)={'tunl0\x00', &(0x7f0000000000)={'syztnl2\x00', r5, 0x10, 0x80, 0x1000, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2}}}}) r6 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f00000000c0)=ANY=[], 0xd8}, 0x1, 0x0, 0x0, 0x4044001}, 0x4000044) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r7, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x4e0, 0x378, 0x180, 0x0, 0x2e0, 0x180, 0x448, 0x448, 0x448, 0x448, 0x448, 0x6, 0x0, {[{{@uncond, 0x0, 0x158, 0x180, 0x0, {}, [@common=@unspec=@conntrack2={{0xc0}, {{@ipv4=@remote, [], @ipv6=@local, [], @ipv4=@private, [], @ipv6=@private1}}}, @common=@ttl={{0x28}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0x218}}, {{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@addrtype={{0x30}}]}, @ECN={0x28}}, {{@ip={@rand_addr, @dev, 0x0, 0x0, 'syzkaller0\x00', 'macvlan1\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x540) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r6, 0x80045530, &(0x7f0000000580)=""/90) 3.9386841s ago: executing program 4 (id=4695): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000040)=ANY=[], 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10}, {0xffff, 0xffff}, {0x0, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x2008085}, 0x41) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000040000100feffffffffdbdf25017c0000040042800c00018006000600800a00001400028010000b800c"], 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0x800c000) sched_setaffinity(0x0, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f7", 0x1}], 0x1}], 0x1, 0x40800) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) add_key(0x0, 0x0, &(0x7f00000000c0)="01", 0x1, 0xfffffffffffffffd) ioctl$UDMABUF_CREATE_LIST(r2, 0x40087543, &(0x7f0000000080)={0x0, 0x300}) r3 = socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r3, 0x84, 0x84, &(0x7f0000000000), 0x90) 3.801820129s ago: executing program 3 (id=4696): r0 = socket$inet_sctp(0x2, 0x5, 0x84) listen(r0, 0x1ff) sched_setscheduler(0x0, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r1, 0x0, 0x0, 0x404c802, 0x0, 0x0) setrlimit(0x40000000000008, &(0x7f0000000000)={0x204, 0x801}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) move_pages(0x0, 0x1, &(0x7f0000000040)=[&(0x7f0000ffc000/0x1000)=nil], &(0x7f0000002640), 0x0, 0x200000000000000) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB, @ANYRESHEX=r2]) read$FUSE(r2, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x540) sendto$inet(r1, 0x0, 0x0, 0x4004084, 0x0, 0x0) 3.750371245s ago: executing program 3 (id=4697): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0xffff, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) syz_open_dev$dri(0x0, 0x0, 0x40) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0xfe33) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc25c4110, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe5, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0xfffd}}}]}, 0x38}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r5 = socket$inet(0x2, 0x2, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) setsockopt$inet_msfilter(r5, 0x0, 0x29, 0x0, 0x57) socket$netlink(0x10, 0x3, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x40938, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) modify_ldt$read_default(0x2, 0xffffffffffffffff, 0x0) 2.287875545s ago: executing program 1 (id=4698): syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000183b9220b113420016580102030109021b00010000000009040000012e459e00090504", @ANYRES8, @ANYRESDEC], 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="680000000b06010200000000000000000000000005000100070000000900020073797a310000000040000780"], 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x80) fstat(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f00000000c0)={"0e00", 0x0, 0x6, 0x3, 0x2, 0x0, "11000200", "00e17cda", "03022000", "fcffffff", ["50d5c2a7c5ae5cace40000b6", "c08e00", "0c436d743497c443084000", "00000000dd5a00"]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a0904000000000006000000000000000001"], 0x84}}, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) r4 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r4, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) r5 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee4, 0x0, 0x10000002, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x8001}}) io_uring_enter(r5, 0x2b93, 0xf9d0, 0x22, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x4000801}, 0xc0c4) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000000000106161154d00000000000109022400010000000009040400010300000009210000000122f80409058103"], 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0xff, 0x0, 0x7fff0026}]}) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x0}, 0x0) syz_usb_control_io$hid(r8, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) setsockopt$inet6_opts(r3, 0x29, 0x40, &(0x7f0000000000)=ANY=[], 0xd0060) getgroups(0x9, &(0x7f0000000040)=[0xee00, 0xee01, 0xee00, 0xffffffffffffffff, 0xee00, 0xee01, 0xffffffffffffffff, 0x0, 0x0]) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1, {r2, r9}}, './file0\x00'}) 2.087499737s ago: executing program 2 (id=4699): r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000480), 0xa400, 0x0) ioctl$NBD_SET_TIMEOUT(r0, 0xab09, 0x7) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f00000004c0)=0x7) fsetxattr$security_capability(r0, &(0x7f0000000500), &(0x7f0000000540)=@v1={0x1000000, [{0x1ff, 0x4}]}, 0xc, 0x1) syz_io_uring_setup(0x7758, &(0x7f0000000580)={0x0, 0x929b, 0x400, 0x0, 0x33c, 0x0, r0}, &(0x7f0000000600)=0x0, &(0x7f0000000640)) syz_io_uring_setup(0x51bd, &(0x7f0000000680)={0x0, 0x9087, 0x10000, 0x3, 0x38f, 0x0, r0}, &(0x7f0000000700), &(0x7f0000000740)=0x0) r3 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000780)=@IORING_OP_WRITE_FIXED={0x5, 0x40, 0x6000, @fd=r0, 0x6, 0x7b, 0x69b8, 0x8, 0x1, {0x1, r3}}) clock_gettime(0x0, &(0x7f00000007c0)={0x0, 0x0}) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000840)=@userptr={0x7fff, 0xa, 0x4, 0x400, 0x4, {r4, r5/1000+60000}, {0x3, 0x0, 0x6, 0x57, 0x2, 0x5, "367847ff"}, 0x6, 0x2, {&(0x7f0000000800)}, 0x4, 0x0, r0}) sendto$inet(r0, &(0x7f00000008c0)="f93caf98dc12f64a3a926e3d7101da35fce79b7311d01a0db50e9ad96ffb206e1db47c3ff5281f58ef53be6a81276257523cd9cbf1a5c7294d0de100d798560e7220fd625abe94b36d21788c271186a70ef3", 0x52, 0x40090, &(0x7f0000000940)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x28}}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000032c0)=@bloom_filter={0x1e, 0x18, 0x9, 0x8, 0x51c14, r0, 0x8, '\x00', 0x0, r0, 0x4, 0x1, 0x0, 0xf}, 0x50) 2.008280027s ago: executing program 0 (id=4700): r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x80) ioctl$I2C_PEC(r0, 0x708, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0_to_team\x00', 0x400}) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(0xffffffffffffffff, 0x40046210, &(0x7f00000002c0)=0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x80) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8}, 0x0) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000300), 0x100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000b00)={0x409, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000180)=@RTM_GETMDB={0x18, 0x56, 0xf23}, 0x18}}, 0x0) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, &(0x7f00000001c0)={""/32, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001580)}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0x7}, {0x1}, {0x7, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x54, 0x2, [@TCA_FW_ACT={0x50, 0x4, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x3513, 0x6, 0xffffffffffffffff, 0xb6b9, 0x3}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x8}}]}, 0x88}, 0x1, 0x0, 0x0, 0x80}, 0x24000880) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f00000000c0)={0x1, 0x1, 0x1, &(0x7f0000000000)={0x17, "90f5000000f3c9f1bd0d00"}}) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000000000)={0x3800, {"e6a3785ef3ea62186288f8d2b35df471", "d35c65ff7462d83df18224e8fe7e024f", "82e70a363e66af9d666e017c542a839d"}, 0x87ad, 0x2}) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) 1.909691161s ago: executing program 2 (id=4701): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f00000003c0), 0x101000, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$video4linux(&(0x7f0000000040), 0x7fff, 0x48b03) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r4, 0x80085665, &(0x7f00000000c0)={0x3, 0x1ff, 0x2}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x3, 0x3cf281) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r5) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) getpid() syz_80211_join_ibss(&(0x7f0000000200)='wlan0\x00', &(0x7f00000002c0)=@default_ap_ssid, 0x6, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) setsockopt$sock_int(r6, 0x1, 0x1, &(0x7f0000000380)=0xfffff272, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x41}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4080) fsetxattr$security_capability(r6, &(0x7f0000000300), &(0x7f0000000340)=@v2={0x2000000, [{0x4be76ba2}, {0x2, 0xfffffffd}]}, 0x14, 0x3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYRES8], 0x3c}, 0x1, 0x0, 0x0, 0x20008800}, 0x200000a0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)=@newlink={0x38, 0x10, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x1181}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}, @IFLA_IFALIASn={0x4}]}, 0x38}}, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) 1.817192047s ago: executing program 3 (id=4702): move_pages(0x0, 0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)=@ipmr_newroute={0x24, 0x18, 0x2, 0x70bd2d, 0x25dfdbfb, {0x80, 0x10, 0x14, 0x9, 0x1, 0xd4dcf8d1cd4b60f0, 0xfe, 0x5, 0x1800}, [@RTA_PRIORITY={0x8, 0x6, 0xc01}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4004010) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) r1 = memfd_create(&(0x7f0000001000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00'/1136, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r5 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000540), 0x301040, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f00000006c0)={&(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0, 0x0], 0x5, 0x4, 0x3, 0x3}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000800)={&(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000007c0)=[0x0, 0x0, 0x0], 0x5, 0x3, 0x4, 0x3}) ioctl$DRM_IOCTL_MODE_GETPLANE(r5, 0xc02064b6, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003340)=@newtfilter={0x78, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x2400}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_bpf={{0x8}, {0x4c, 0x2, [@TCA_BPF_POLICE={0x40, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x8, 0xf2ff, 0x2, 0x9, 0xfffff800, {0x8f, 0x0, 0x10, 0x13b0, 0x200}, {0x10, 0x2, 0x200, 0x1, 0x7, 0x7}, 0x9, 0x7fff, 0x8a}}]}, @TCA_BPF_FD={0x8}]}}]}, 0x78}}, 0x0) r6 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) write$binfmt_script(r6, &(0x7f0000002040)={'#! ', './file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0'}, 0x1002) execveat(r6, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = syz_usb_connect(0x5, 0x4c, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201100335fe6510ca1a8eb232920102030109023a00010d019002090432a70201039e08090588061000060408082387ac33afe3410725010305f804090507020002040266072501"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) r8 = fsopen(&(0x7f0000000480)='squashfs\x00', 0x0) fsmount(r8, 0x1, 0x5) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r10 = accept4(r9, 0x0, 0x0, 0x800) sendmmsg$alg(r10, &(0x7f0000000040)=[{0xff8d, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3}], 0x1, 0x40800) syz_usb_control_io$cdc_ncm(r7, &(0x7f00000000c0)={0x14, &(0x7f00000008c0)=ANY=[@ANYBLOB="400562000000620bd0ee44b867edc4e7d1752ba363b7defe459dc7cc528e3417500a6b3f593432b678e2b9297ccdf280fd3968dcda2b8b4dd7e1f1bae9dabd54e953e46a3bce6d3cd09800277deac753ef4ab32d940d000ac74010d8d5e249a659fc011e6ea587b08a0f36114d5a3f20b34cd6aa6cd42b324cc95ac34fb368908a8273809851d19990f046ee105967218a6764e94f17a9fb52a7cfab52af1a4ddf8075856e60ce6b46db4dde323429b4c28c98e189685e970327177e8bcfb5a3c5e965c12410662917252e3ecff0b0c4f20e843fc7f5822797ec20da1d8266ca4e3d2ae3e367db3b0383443478c31c13cf790f17b02b90427d4c5d6ac8ce513bf723b3d499a858d84a7280e8e2e5adfd37398a75e47556825fe7915de47b91bf9e0eb2dc61361f56b4abdf6056480955228a5cb9ade8a9527137ccf0e47b63f7844ebef901652769cbd2b9b9bdb66b523dc40dc2e72c4c9efc22a6b10b766e6fb9e587091b616b800a2e2eb2821e5dab81b7a0bfa731d71bd8fce2a49a40fb16b73c7cc475fabcb000b48fae126e7260c3d8e430121fd842eccd73fb702f910a631a4276bd0a7853e768ce127de83762d164e6c078d120d6d27d830265510762fe27b9876149dbaaf617c1c50b541e7ea007d64250cef431bf9040e822bcff521a5e9760815c4f43db8d7accef71082f410e15c9d36365ba540745cafe4b4048368a283ddaa2481763b989e836caac764b7e4013b067b1c2a82cb7b9b723c81c5a9625a5bf12547c8653236cc4cb21d53a279b966af9e12553e03d5cdf49f6a1b297b9d4019633219eb225807640daea65bf008ee079a3fb3d5447c0ab1f8c48f0709569c19e6948c5f2be0070fbce6651980b38a87d346e86ec0a5580a41530375964a48aefc120645544dc89251f630536e4838d3ab0171ff07941eddbd6f81ae2d3d44fee53ef4dc66cb81c000000000000089bfff0b75b2f0de3cadd4186055339a8948db29395a505b967752d9bdfa0f120a02813e95ee577aea1994f434667b604aeaf097caef61286e029e73c51"], &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000400)={0x44, &(0x7f0000000100)=ANY=[@ANYBLOB="00014a0000003431b0be14eb5aaf1ce6dade576a1ccd88bf6680e96638a9da2af3a3d3890a70f91501000000000000006588deecbce5252a8dd3df10657e5770080f47d28a9bef5037f1c5f9c56fa4d8"], &(0x7f0000000180)={0x0, 0xa, 0x1, 0x8}, &(0x7f0000000200)={0x0, 0x8, 0x1, 0xb1}, &(0x7f0000000240)={0x20, 0x80, 0x1c, {0x8e3, 0x3, 0x9, 0x10, 0x4, 0xf, 0x6, 0x1, 0xd887, 0xaa5, 0x3, 0x5ac}}, &(0x7f0000000280)={0x20, 0x85, 0x4, 0xd}, &(0x7f0000000340)={0x20, 0x83, 0x2}, &(0x7f0000000380)={0x20, 0x87, 0x2, 0xfffa}, &(0x7f00000003c0)={0x20, 0x89, 0x2, 0x1}}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r1, 0x0) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000040)=0x8, 0x4) 1.790358207s ago: executing program 4 (id=4703): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000180), 0xfea7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16, @ANYBLOB="ff83"], 0x4}}, 0x0) sendfile(r2, r0, 0x0, 0x100000000) (fail_nth: 3) 1.312601638s ago: executing program 4 (id=4704): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f00000000c0)={0x84, @rand_addr=0x64010100, 0x4e22, 0x3, 'wlc\x00', 0x11, 0xa, 0x69}, 0x2c) socket$kcm(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x2245, 0xfa11, 0xffffffff}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x2245, 0xfa11, 0xffffffff}, 0x0) epoll_create1(0x0) socket$inet6(0xa, 0x2, 0x0) (async) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) (async) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r3, &(0x7f0000001380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)}, 0xb051}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000500)=""/86, 0x56}, {0x0}], 0x2, &(0x7f0000001780)=""/22, 0x16}, 0x81}, {{&(0x7f0000000340)=@in={0x2, 0x0, @empty}, 0x80, &(0x7f0000000240)=[{0x0}, {&(0x7f00000001c0)=""/17, 0x11}], 0x2, &(0x7f00000003c0)=""/119, 0x77}, 0xfffffff9}, {{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000840)=""/203, 0xcb}, {&(0x7f0000000940)=""/189, 0xbd}, {&(0x7f0000000f80)=""/102, 0x66}, {&(0x7f0000000a00)=""/97, 0x61}, {&(0x7f0000000a80)=""/87, 0x57}, {&(0x7f0000000740)=""/27, 0x1b}, {&(0x7f0000000b00)=""/201, 0xc9}, {&(0x7f0000000c40)=""/218, 0xda}, {&(0x7f0000000d40)=""/108, 0x6c}], 0x9, &(0x7f0000000e80)=""/43, 0x2b}, 0x5}, {{&(0x7f0000000ec0)=@caif=@rfm, 0x80, &(0x7f0000001080)=[{&(0x7f0000001500)=""/58, 0x3a}, {&(0x7f0000001840)=""/4096, 0x1000}, {&(0x7f0000002840)=""/4096, 0x1000}, {&(0x7f0000001640)=""/204, 0xcc}], 0x4}, 0x100}, {{&(0x7f00000010c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000001340)=[{&(0x7f0000001140)=""/71, 0x47}, {&(0x7f00000011c0)=""/119, 0x77}, {0x0}], 0x3}, 0x80}], 0x6, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x31, &(0x7f0000000000)=0x1, 0x4) (async) setsockopt$inet6_int(r3, 0x29, 0x31, &(0x7f0000000000)=0x1, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r4, &(0x7f0000000640)=ANY=[@ANYBLOB="0800080007000000000014000000456f007800660000401190780a010102ac1414124e204e20006490780200000000000000040000007580485a402bf08bb0a89c3f0b3c3ab25eba4a04c60808bf3507b6eb705f3c02e0d6370ae4bef1c38d2d97385a7d432a5afb05b0120ec4dd832c0cf27c7c4c03b8e4daaa6228da2e49b8081579ab3712fcfffd27ecd89a202d0d3f5da48418f72f21fa41760dd28b24283bd37229ab6d6e7f68effd6db7adf99fae44ec7f72d99200852c"], 0x86) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, 0x0, &(0x7f0000000c00)='GPL\x00'}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000800000008", @ANYRES8=r4], 0x50) unshare(0x8040480) socket$unix(0x1, 0x1, 0x0) (async) socket$unix(0x1, 0x1, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0xa00, 0xa00}) (async) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0xa00, 0xa00}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) fsopen(&(0x7f0000000080)='qnx4\x00', 0x1) (async) fsopen(&(0x7f0000000080)='qnx4\x00', 0x1) r6 = syz_open_dev$cec(&(0x7f0000000140), 0x0, 0x80) fstat(r6, &(0x7f00000002c0)) (async) fstat(r6, &(0x7f00000002c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket(0x10, 0x3, 0x0) 354.458014ms ago: executing program 4 (id=4705): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) syz_emit_ethernet(0x9a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6a00000000641100fe8000000000000000000000000000aaff02000000000000ff000000000000014e1d4e3f0064907802000000030000000200f8ff53e90dade0f83f43817a33a14e885678a5f38ab436"], 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000380)=ANY=[@ANYBLOB="03070000b5"], 0xc8) write$binfmt_aout(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="03040000b500000001008aea0000feff"], 0xc8) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) close(r3) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x106, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x38}}, {0xa, 0x0, 0x6, @mcast1, 0x50282d11}, r4, 0x3}}, 0x48) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000600)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f00000005c0)=0xffffffff, r4, 0x0, 0x2, 0x4}}, 0x20) sendmsg$ETHTOOL_MSG_CHANNELS_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000006ad873"], 0x14}, 0x1, 0x0, 0x0, 0x20000040}, 0x10) write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001a9"], 0xfdef) 169.037219ms ago: executing program 0 (id=4706): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) fsopen(&(0x7f0000000580)='overlay\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0x0, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48}) recvfrom(r0, &(0x7f00000002c0)=""/187, 0xbb, 0x2102, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x42, 0x4, 0x348, 0xffffffff, 0x1b8, 0x0, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0xf}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r4, 0x4611, 0x3) ioctl$FBIO_WAITFORVSYNC(r4, 0x40044620, 0x0) dup(0xffffffffffffffff) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x10, 0x803, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x90, 0x2c, 0xe27, 0xfffffff9, 0x0, {0x0, 0x0, 0x0, r8, {0xc, 0xc}, {}, {0x5, 0xa}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x60, 0x2, [@TCA_CGROUP_ACT={0x5c, 0x1, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0xbce, 0x1000, 0x20000000, 0x0, 0x10001}}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xf}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x3}]}, {0x4}, {0xc, 0x3f}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0x90}}, 0x20040054) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x4000800) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000060a010400000000000000000a0000010900010073797a31000000001c0004801800018008000100666962000c00028008000240240000030900020073797a320000"], 0x70}, 0x1, 0x0, 0x0, 0x4000854}, 0x20000040) 97.038883ms ago: executing program 4 (id=4707): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000200)={0x1, 0x6, 0x1, &(0x7f0000000080)={0x11, "cc9efc7ddb01702fa9a7ff7d040b99000000000700"}}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) userfaultfd(0x80801) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 0s ago: executing program 2 (id=4708): semget$private(0x0, 0x6, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x7fffc, {0x0, 0x0, 0x0, r5, {}, {0x2, 0xb}, {0x9, 0x5}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x9, 0x7, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0e9}, 0x4000010) close(r2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001400030500008000ffdbdf2502075bff", @ANYRES32=r11, @ANYBLOB="080002007f00000108000400ac1e00011400"], 0x3c}, 0x1, 0x0, 0x0, 0xc090}, 0x0) ioctl$sock_inet_SIOCSIFADDR(r8, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) kernel console output (not intermixed with test programs): hanging to 0x83 [ 1438.688600][ T5956] usb 2-1: Product: syz [ 1438.701220][ T5956] usb 2-1: Manufacturer: syz [ 1438.706243][ T798] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1438.721582][ T5956] usb 2-1: SerialNumber: syz [ 1438.738997][ T798] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1438.748994][ T5956] usb 2-1: config 0 descriptor?? [ 1438.757649][ T5956] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1438.767622][ T798] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1438.777125][ T5956] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1438.784793][ T798] usb 4-1: Product: syz [ 1438.790623][ T798] usb 4-1: Manufacturer: syz [ 1438.795546][ T798] usb 4-1: SerialNumber: syz [ 1438.821367][ T798] usb 4-1: config 0 descriptor?? [ 1438.830994][ T798] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1438.848204][ T798] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 1439.680066][ T5956] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1439.686821][ T5956] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 1439.800540][ T798] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1439.807327][ T798] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 1439.948353][ T5890] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 1440.115394][ T5890] usb 3-1: Using ep0 maxpacket: 32 [ 1440.160028][ T5890] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 1440.177841][ T5890] usb 3-1: config 0 has no interface number 0 [ 1440.218616][ T5890] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1440.227697][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1440.256015][ T5890] usb 3-1: Product: syz [ 1440.283169][ T5890] usb 3-1: Manufacturer: syz [ 1440.308000][ T5890] usb 3-1: SerialNumber: syz [ 1440.324680][ T5956] em28xx 2-1:0.0: Unknown AC97 audio processor detected! [ 1440.344432][ T5956] em28xx 2-1:0.0: couldn't setup AC97 register 2 [ 1440.364657][ T5890] usb 3-1: config 0 descriptor?? [ 1440.373527][ T5956] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 1440.420045][ T798] em28xx 4-1:0.0: Unknown AC97 audio processor detected! [ 1440.436519][ T798] em28xx 4-1:0.0: couldn't setup AC97 register 2 [ 1440.469753][ T798] em28xx 4-1:0.0: couldn't setup AC97 register 4 [ 1440.620076][ T5890] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1440.834299][ T5890] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1440.870618][ T5890] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1441.099488][ T5956] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 1441.106061][ T798] em28xx 4-1:0.0: couldn't setup AC97 register 6 [ 1441.126610][ T5956] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 1441.137992][ T798] em28xx 4-1:0.0: couldn't setup AC97 register 54 [ 1441.179885][ T5956] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 1441.188738][ T798] em28xx 4-1:0.0: couldn't setup AC97 register 56 [ 1441.213183][ T5956] usb 2-1: USB disconnect, device number 93 [ 1441.228939][ T798] usb 4-1: USB disconnect, device number 118 [ 1441.300724][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1441.301175][ T5930] usb 3-1: USB disconnect, device number 101 [ 1441.342775][ T5930] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1441.388268][ T5930] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1441.414660][ T5930] quatech2 3-1:0.51: device disconnected [ 1442.033132][T23518] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4260'. [ 1442.100909][T23518] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4260'. [ 1442.177924][T23518] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4260'. [ 1442.498619][T23529] FAULT_INJECTION: forcing a failure. [ 1442.498619][T23529] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1442.561434][T23529] CPU: 1 UID: 0 PID: 23529 Comm: syz.0.4261 Tainted: G L syzkaller #0 PREEMPT(full) [ 1442.561466][T23529] Tainted: [L]=SOFTLOCKUP [ 1442.561473][T23529] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1442.561484][T23529] Call Trace: [ 1442.561492][T23529] [ 1442.561500][T23529] dump_stack_lvl+0xe8/0x150 [ 1442.561520][T23529] should_fail_ex+0x412/0x560 [ 1442.561536][T23529] _copy_from_user+0x2d/0xb0 [ 1442.561552][T23529] kvm_arch_dev_ioctl+0x3b6/0x9e0 [ 1442.561596][T23529] ? do_vfs_ioctl+0x1166/0x1530 [ 1442.561609][T23529] ? __pfx_kvm_arch_dev_ioctl+0x10/0x10 [ 1442.561622][T23529] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1442.561639][T23529] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1442.561657][T23529] kvm_dev_ioctl+0x59e/0x1590 [ 1442.561673][T23529] ? __fget_files+0x2a/0x420 [ 1442.561690][T23529] ? __fget_files+0x2a/0x420 [ 1442.561703][T23529] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 1442.561716][T23529] ? __fget_files+0x2a/0x420 [ 1442.561731][T23529] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1442.561746][T23529] ? __pfx_kvm_dev_ioctl+0x10/0x10 [ 1442.561760][T23529] __se_sys_ioctl+0xfc/0x170 [ 1442.561772][T23529] do_syscall_64+0x14d/0xf80 [ 1442.561785][T23529] ? trace_irq_disable+0x3b/0x150 [ 1442.561799][T23529] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.561809][T23529] ? clear_bhb_loop+0x40/0x90 [ 1442.561821][T23529] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1442.561831][T23529] RIP: 0033:0x7fdd6db9c799 [ 1442.561842][T23529] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1442.561851][T23529] RSP: 002b:00007fdd6eb0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1442.561862][T23529] RAX: ffffffffffffffda RBX: 00007fdd6de15fa0 RCX: 00007fdd6db9c799 [ 1442.561870][T23529] RDX: 0000000000000000 RSI: 000000004018aee2 RDI: 0000000000000003 [ 1442.561876][T23529] RBP: 00007fdd6eb0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1442.561882][T23529] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1442.561888][T23529] R13: 00007fdd6de16038 R14: 00007fdd6de15fa0 R15: 00007fdd6df3fa48 [ 1442.561903][T23529] [ 1443.102079][ T5905] vhci_hcd vhci_hcd.4: vhci_device speed not set [ 1444.337913][ T5930] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1444.527961][ T5956] usb 3-1: new full-speed USB device number 102 using dummy_hcd [ 1444.564149][ T5930] usb 2-1: Using ep0 maxpacket: 8 [ 1444.636052][ T5930] usb 2-1: config 64 has an invalid interface number: 19 but max is 0 [ 1444.644364][ T5930] usb 2-1: config 64 has no interface number 0 [ 1444.650913][ T5930] usb 2-1: config 64 interface 19 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1444.688992][ T5930] usb 2-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=3f.e0 [ 1444.709974][ T5956] usb 3-1: config 1 has an invalid descriptor of length 133, skipping remainder of the config [ 1444.725163][ T5930] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1444.735279][ T5956] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1444.773145][ T5930] usb 2-1: probing VID:PID(2201:012C) [ 1444.787702][ T5956] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1444.826614][ T5930] usb 2-1: vub300 testing UNKNOWN EndPoint(0) 02 [ 1444.838314][ T5956] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1444.848198][ T5930] usb 2-1: vub300 ignoring EndPoint(0) 02 [ 1444.858679][ T5956] usb 3-1: Product: syz [ 1444.866761][ T5930] usb 2-1: Could not find two sets of bulk-in/out endpoint pairs [ 1444.874613][ T5956] usb 3-1: Manufacturer: syz [ 1444.881280][ T5956] usb 3-1: SerialNumber: syz [ 1444.886985][ T5930] vub300 2-1:64.19: probe with driver vub300 failed with error -22 [ 1445.121650][ T5956] usb 3-1: 0:2 : does not exist [ 1445.163355][ T5956] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 1445.212519][ T5828] Bluetooth: hci1: unexpected event 0x2f length: 509 > 260 [ 1445.263857][ T5956] usb 3-1: USB disconnect, device number 102 [ 1445.369971][T23568] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4270'. [ 1445.385359][T11115] udevd[11115]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1445.409149][T23568] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4270'. [ 1445.418690][T23568] netlink: 'syz.0.4270': attribute type 19 has an invalid length. [ 1445.518448][T23568] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4270'. [ 1445.764176][T23574] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4272'. [ 1445.773148][T23574] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4272'. [ 1445.782101][T23574] netlink: 'syz.4.4272': attribute type 19 has an invalid length. [ 1445.790004][T23574] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4272'. [ 1445.935266][T23578] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4274'. [ 1446.103868][T23581] FAULT_INJECTION: forcing a failure. [ 1446.103868][T23581] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1446.131503][T23579] bridge27: port 1(veth23) entered blocking state [ 1446.138551][T23581] CPU: 0 UID: 0 PID: 23581 Comm: syz.3.4275 Tainted: G L syzkaller #0 PREEMPT(full) [ 1446.138589][T23581] Tainted: [L]=SOFTLOCKUP [ 1446.138596][T23581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1446.138607][T23581] Call Trace: [ 1446.138616][T23581] [ 1446.138624][T23581] dump_stack_lvl+0xe8/0x150 [ 1446.138655][T23581] should_fail_ex+0x412/0x560 [ 1446.138682][T23581] _copy_from_user+0x2d/0xb0 [ 1446.138708][T23581] kstrtouint_from_user+0xd6/0x180 [ 1446.138731][T23581] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1446.138770][T23581] proc_fail_nth_write+0x8e/0x210 [ 1446.138797][T23581] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1446.138828][T23581] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1446.138855][T23581] vfs_write+0x29a/0xb90 [ 1446.138883][T23581] ? __pfx_vfs_write+0x10/0x10 [ 1446.138904][T23581] ? __fget_files+0x2a/0x420 [ 1446.138934][T23581] ? __fget_files+0x3a0/0x420 [ 1446.138958][T23581] ? __fget_files+0x2a/0x420 [ 1446.138990][T23581] ksys_write+0x150/0x270 [ 1446.139012][T23581] ? __pfx_ksys_write+0x10/0x10 [ 1446.139041][T23581] do_syscall_64+0x14d/0xf80 [ 1446.139059][T23581] ? trace_irq_disable+0x3b/0x150 [ 1446.139084][T23581] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.139102][T23581] ? clear_bhb_loop+0x40/0x90 [ 1446.139125][T23581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1446.139144][T23581] RIP: 0033:0x7f406bd5cfce [ 1446.139163][T23581] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1446.139179][T23581] RSP: 002b:00007f406cb83fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1446.139199][T23581] RAX: ffffffffffffffda RBX: 00007f406cb846c0 RCX: 00007f406bd5cfce [ 1446.139212][T23581] RDX: 0000000000000001 RSI: 00007f406cb840a0 RDI: 0000000000000004 [ 1446.139225][T23581] RBP: 00007f406cb84090 R08: 0000000000000000 R09: 0000000000000000 [ 1446.139237][T23581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1446.139252][T23581] R13: 00007f406c016038 R14: 00007f406c015fa0 R15: 00007f406c13fa48 [ 1446.139282][T23581] [ 1446.358119][T23579] bridge27: port 1(veth23) entered disabled state [ 1446.364988][T23579] veth23: entered allmulticast mode [ 1446.371567][T23579] veth23: entered promiscuous mode [ 1446.465934][T23579] bridge27: port 2(veth25) entered blocking state [ 1446.472496][T23579] bridge27: port 2(veth25) entered disabled state [ 1446.480082][T23579] veth25: entered allmulticast mode [ 1446.486384][T23579] veth25: entered promiscuous mode [ 1447.061142][T23592] syzkaller0: entered promiscuous mode [ 1447.066713][T23592] syzkaller0: entered allmulticast mode [ 1447.079526][T23592] tipc: Enabled bearer , priority 0 [ 1447.247722][T23582] tipc: Resetting bearer [ 1447.377651][T23582] tipc: Disabling bearer [ 1447.845206][ T5930] usb 2-1: USB disconnect, device number 94 [ 1449.373159][ T5828] Bluetooth: hci2: unexpected event 0x2f length: 509 > 260 [ 1450.227882][ T5905] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 1450.419008][ T5905] usb 3-1: Using ep0 maxpacket: 16 [ 1450.464148][ T5905] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1450.502058][T23638] tipc: Enabled bearer , priority 0 [ 1450.515940][ T5905] usb 3-1: config 13 has an invalid interface number: 50 but max is 0 [ 1450.524696][ T5905] usb 3-1: config 13 has no interface number 0 [ 1450.534920][ T5905] usb 3-1: config 13 interface 50 altsetting 167 bulk endpoint 0x88 has invalid maxpacket 16 [ 1450.564025][ T5905] usb 3-1: config 13 interface 50 has no altsetting 0 [ 1450.585468][ T5905] usb 3-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 1450.594868][ T5905] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1450.603146][ T5905] usb 3-1: Product: syz [ 1450.607505][ T5905] usb 3-1: Manufacturer: syz [ 1450.613374][ T5905] usb 3-1: SerialNumber: syz [ 1450.668310][T23628] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1451.096333][ T5905] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1451.110147][ T5905] usb 3-1: MIDIStreaming interface descriptor not found [ 1451.297931][ T5930] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1451.360143][ T5905] usb 3-1: USB disconnect, device number 103 [ 1451.552146][T23637] tipc: Disabling bearer [ 1451.564354][ T5930] usb 2-1: Using ep0 maxpacket: 32 [ 1451.607673][ T5930] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1451.635095][ T5930] usb 2-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 1451.666346][ T5930] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1451.680261][ T5930] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1451.716887][ T5930] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1451.734296][ T5930] usb 2-1: Product: syz [ 1451.745025][ T5930] usb 2-1: Manufacturer: syz [ 1451.755754][ T5930] usb 2-1: SerialNumber: syz [ 1451.794702][ T5930] usb 2-1: config 0 descriptor?? [ 1451.807917][T20117] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1451.986920][ T5956] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 1452.137930][ T5956] usb 4-1: Using ep0 maxpacket: 32 [ 1452.145838][ T5956] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 1452.156231][ T5956] usb 4-1: config 0 has no interface number 0 [ 1452.174468][ T5956] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1452.185513][ T5956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1452.200632][ T5956] usb 4-1: Product: syz [ 1452.209842][ T5956] usb 4-1: Manufacturer: syz [ 1452.221305][ T5930] gs_usb 2-1:0.0: Configuring for 1 interfaces [ 1452.228198][ T798] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 1452.241034][ T5956] usb 4-1: SerialNumber: syz [ 1452.260312][ T5956] usb 4-1: config 0 descriptor?? [ 1452.274823][ T5956] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1452.387937][ T798] usb 3-1: Using ep0 maxpacket: 8 [ 1452.395841][ T798] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1452.404759][ T798] usb 3-1: config 0 has no interface number 0 [ 1452.412293][ T798] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1452.423676][ T798] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1452.446036][ T798] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1452.580049][ T5956] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1452.591424][ T798] usb 3-1: config 0 descriptor?? [ 1452.602528][ T798] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1452.643733][ T5930] usb 2-1: USB disconnect, device number 95 [ 1452.667194][ T5956] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1452.890309][T23655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1452.900247][T23655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1452.928738][T23655] dtv5100: wlen = 0, aborting. [ 1453.359090][T23664] fuse: Bad value for 'user_id' [ 1453.374869][T23664] fuse: Bad value for 'user_id' [ 1453.438924][T23669] binder: 23661:23669 ioctl c00c620f 200000000140 returned -22 [ 1453.635269][T23673] fuse: Bad value for 'fd' [ 1454.805443][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1454.815628][ T5905] usb 4-1: USB disconnect, device number 119 [ 1454.875834][ T5905] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1455.063125][ T5905] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1455.130867][ T5905] quatech2 4-1:0.51: device disconnected [ 1455.211937][ T5890] usb 3-1: USB disconnect, device number 104 [ 1457.716134][T23722] FAULT_INJECTION: forcing a failure. [ 1457.716134][T23722] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1457.744537][T23722] CPU: 0 UID: 0 PID: 23722 Comm: syz.3.4304 Tainted: G L syzkaller #0 PREEMPT(full) [ 1457.744567][T23722] Tainted: [L]=SOFTLOCKUP [ 1457.744574][T23722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1457.744584][T23722] Call Trace: [ 1457.744592][T23722] [ 1457.744599][T23722] dump_stack_lvl+0xe8/0x150 [ 1457.744630][T23722] should_fail_ex+0x412/0x560 [ 1457.744658][T23722] _copy_from_user+0x2d/0xb0 [ 1457.744685][T23722] ___sys_recvmsg+0x175/0x590 [ 1457.744703][T23722] ? __lock_acquire+0x6b5/0x2cf0 [ 1457.744729][T23722] ? __pfx____sys_recvmsg+0x10/0x10 [ 1457.744796][T23722] do_recvmmsg+0x334/0x800 [ 1457.744823][T23722] ? __pfx_do_recvmmsg+0x10/0x10 [ 1457.744852][T23722] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1457.744888][T23722] __x64_sys_recvmmsg+0x198/0x250 [ 1457.744910][T23722] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1457.744939][T23722] do_syscall_64+0x14d/0xf80 [ 1457.744955][T23722] ? trace_irq_disable+0x3b/0x150 [ 1457.744979][T23722] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.744996][T23722] ? clear_bhb_loop+0x40/0x90 [ 1457.745018][T23722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.745037][T23722] RIP: 0033:0x7f406bd9c799 [ 1457.745054][T23722] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1457.745070][T23722] RSP: 002b:00007f4069ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1457.745092][T23722] RAX: ffffffffffffffda RBX: 00007f406c016090 RCX: 00007f406bd9c799 [ 1457.745106][T23722] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005 [ 1457.745118][T23722] RBP: 00007f4069ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1457.745130][T23722] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 1457.745141][T23722] R13: 00007f406c016128 R14: 00007f406c016090 R15: 00007f406c13fa48 [ 1457.745170][T23722] [ 1458.116262][T23727] fuse: Bad value for 'fd' [ 1458.340523][T23721] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4303'. [ 1458.349610][T23721] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4303'. [ 1458.358672][T23721] netlink: 'syz.4.4303': attribute type 19 has an invalid length. [ 1458.366598][T23721] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4303'. [ 1458.701204][T23738] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4307'. [ 1458.710332][T23738] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4307'. [ 1458.724430][T23738] netlink: 'syz.3.4307': attribute type 19 has an invalid length. [ 1458.738010][T23738] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4307'. [ 1458.791351][T23733] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4305'. [ 1459.339610][T23742] binder: 23739:23742 ioctl c00c620f 200000000140 returned -22 [ 1460.015563][T23750] input: syz1 as /devices/virtual/input/input145 [ 1461.213050][ T5890] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 1461.383176][ T5890] usb 2-1: Using ep0 maxpacket: 16 [ 1461.400181][ T5890] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1461.410249][ T5890] usb 2-1: config 13 has an invalid interface number: 50 but max is 0 [ 1461.444295][ T5890] usb 2-1: config 13 has no interface number 0 [ 1461.458069][ T5890] usb 2-1: config 13 interface 50 altsetting 167 bulk endpoint 0x88 has invalid maxpacket 16 [ 1461.477991][ T5890] usb 2-1: config 13 interface 50 has no altsetting 0 [ 1461.528138][ T5890] usb 2-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 1461.537434][ T5890] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1461.545734][ T5890] usb 2-1: Product: syz [ 1461.560209][ T5890] usb 2-1: Manufacturer: syz [ 1461.564821][ T5890] usb 2-1: SerialNumber: syz [ 1461.637661][T23771] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1461.666362][T23780] fuse: Bad value for 'fd' [ 1462.073535][ T5890] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1462.212947][ T5890] usb 2-1: MIDIStreaming interface descriptor not found [ 1462.508027][ T5930] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 1462.527195][ T5890] usb 2-1: USB disconnect, device number 97 [ 1462.707902][ T5930] usb 4-1: Using ep0 maxpacket: 8 [ 1462.708606][T23790] tipc: Enabled bearer , priority 0 [ 1462.725907][ T5930] usb 4-1: config 64 has an invalid interface number: 19 but max is 0 [ 1462.765060][ T5930] usb 4-1: config 64 has no interface number 0 [ 1462.785325][ T5930] usb 4-1: config 64 interface 19 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1462.816841][ T5930] usb 4-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=3f.e0 [ 1462.837526][ T5930] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1462.895878][ T5930] usb 4-1: probing VID:PID(2201:012C) [ 1462.932005][T23793] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1462.941654][T23793] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1462.958859][ T5930] usb 4-1: vub300 testing UNKNOWN EndPoint(0) 02 [ 1462.965249][ T5930] usb 4-1: vub300 ignoring EndPoint(0) 02 [ 1462.997943][ T5930] usb 4-1: Could not find two sets of bulk-in/out endpoint pairs [ 1463.023103][ T5930] vub300 4-1:64.19: probe with driver vub300 failed with error -22 [ 1463.506522][T23789] tipc: Disabling bearer [ 1464.535992][T23817] binder: 23812:23817 ioctl c00c620f 200000000140 returned -22 [ 1464.856205][T23823] xt_policy: neither incoming nor outgoing policy selected [ 1464.978060][ T5930] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 1465.090895][ T798] usb 4-1: USB disconnect, device number 120 [ 1465.130073][ T5890] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 1465.149802][ T5930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1465.162159][ T5930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1465.172929][ T5930] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1465.182150][ T5930] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1465.190559][ T5930] usb 3-1: Manufacturer: syz [ 1465.196809][ T5930] usb 3-1: config 0 descriptor?? [ 1465.339342][ T5890] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1465.357916][ T5890] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1465.368162][ T5890] usb 2-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 1465.377219][ T5890] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1465.395184][ T5890] usb 2-1: config 0 descriptor?? [ 1465.514499][T23830] team0: Device gtp0 is of different type [ 1465.585582][T23836] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1465.630359][ T5930] pyra 0003:1E7D:2CF6.0027: unknown main item tag 0x0 [ 1465.642731][T23836] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1465.651229][ T5930] pyra 0003:1E7D:2CF6.0027: unknown main item tag 0x0 [ 1465.661937][ T5930] pyra 0003:1E7D:2CF6.0027: unknown main item tag 0x0 [ 1465.674544][ T5930] pyra 0003:1E7D:2CF6.0027: unknown main item tag 0x0 [ 1465.683677][ T5930] pyra 0003:1E7D:2CF6.0027: unknown main item tag 0x0 [ 1465.690803][ T5930] pyra 0003:1E7D:2CF6.0027: unknown main item tag 0x0 [ 1465.698095][ T5930] pyra 0003:1E7D:2CF6.0027: unknown main item tag 0x0 [ 1465.714366][ T5930] pyra 0003:1E7D:2CF6.0027: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.2-1/input0 [ 1465.878165][T15942] wlan0: Trigger new scan to find an IBSS to join [ 1465.893470][ T5890] hid-steam 0003:28DE:1102.0028: unknown main item tag 0x0 [ 1465.906945][ T5890] hid-steam 0003:28DE:1102.0028: : USB HID v0.00 Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0 [ 1466.039320][ T5890] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.050428][ T5890] hid-steam 0003:28DE:1102.0028: Steam Controller 'XXXXXXXXXX' connected [ 1466.059665][ T5890] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.069530][ T5890] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.088086][T23825] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4330'. [ 1466.088506][ T5930] pyra 0003:1E7D:2CF6.0027: couldn't init struct pyra_device [ 1466.104813][ T5930] pyra 0003:1E7D:2CF6.0027: couldn't install mouse [ 1466.110713][ T5890] input: Steam Controller as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:28DE:1102.0028/input/input146 [ 1466.145766][ T5930] pyra 0003:1E7D:2CF6.0027: probe with driver pyra failed with error -71 [ 1466.175876][ T5178] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.204281][ T5178] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.215269][ T5890] hid-steam 0003:28DE:1102.0029: unknown main item tag 0x0 [ 1466.230382][ T5930] usb 3-1: USB disconnect, device number 105 [ 1466.249490][ T5178] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.276666][ T5178] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.290489][T23843] FAULT_INJECTION: forcing a failure. [ 1466.290489][T23843] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1466.293595][ T5890] hid-steam 0003:28DE:1102.0029: hidraw0: USB HID v0.00 Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0 [ 1466.344705][ T5890] usb 2-1: USB disconnect, device number 98 [ 1466.372390][ T5178] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.392656][T23843] CPU: 1 UID: 0 PID: 23843 Comm: syz.0.4334 Tainted: G L syzkaller #0 PREEMPT(full) [ 1466.392686][T23843] Tainted: [L]=SOFTLOCKUP [ 1466.392693][T23843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1466.392705][T23843] Call Trace: [ 1466.392713][T23843] [ 1466.392720][T23843] dump_stack_lvl+0xe8/0x150 [ 1466.392754][T23843] should_fail_ex+0x412/0x560 [ 1466.392785][T23843] _copy_to_user+0x31/0xb0 [ 1466.392813][T23843] simple_read_from_buffer+0xe1/0x170 [ 1466.392844][T23843] proc_fail_nth_read+0x1bb/0x230 [ 1466.392871][T23843] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1466.392899][T23843] ? rw_verify_area+0x2a6/0x4d0 [ 1466.392917][T23843] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1466.392942][T23843] vfs_read+0x20c/0xa70 [ 1466.392959][T23843] ? fdget_pos+0x246/0x320 [ 1466.392984][T23843] ? __pfx___mutex_lock+0x10/0x10 [ 1466.393002][T23843] ? __pfx_vfs_read+0x10/0x10 [ 1466.393020][T23843] ? __fget_files+0x2a/0x420 [ 1466.393047][T23843] ? __fget_files+0x3a0/0x420 [ 1466.393071][T23843] ? __fget_files+0x2a/0x420 [ 1466.393102][T23843] ksys_read+0x150/0x270 [ 1466.393133][T23843] ? __pfx_ksys_read+0x10/0x10 [ 1466.393149][T23843] ? fput+0xa0/0xd0 [ 1466.393183][T23843] do_syscall_64+0x14d/0xf80 [ 1466.393200][T23843] ? trace_irq_disable+0x3b/0x150 [ 1466.393225][T23843] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1466.393244][T23843] ? clear_bhb_loop+0x40/0x90 [ 1466.393266][T23843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1466.393284][T23843] RIP: 0033:0x7fdd6db5cfce [ 1466.393302][T23843] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1466.393317][T23843] RSP: 002b:00007fdd6eb09fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1466.393336][T23843] RAX: ffffffffffffffda RBX: 00007fdd6eb0a6c0 RCX: 00007fdd6db5cfce [ 1466.393348][T23843] RDX: 000000000000000f RSI: 00007fdd6eb0a0a0 RDI: 0000000000000004 [ 1466.393360][T23843] RBP: 00007fdd6eb0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1466.393371][T23843] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1466.393382][T23843] R13: 00007fdd6de16038 R14: 00007fdd6de15fa0 R15: 00007fdd6df3fa48 [ 1466.393408][T23843] [ 1466.624771][T23844] fido_id[23844]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 1466.675239][ T5178] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.686810][ T5890] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.701735][T23846] tipc: Enabled bearer , priority 0 [ 1466.718648][ T5890] hid-steam 0003:28DE:1102.0028: No HID_FEATURE_REPORT submitted - nothing to read [ 1466.835922][ T5890] hid-steam 0003:28DE:1102.0028: Steam Controller 'XXXXXXXXXX' disconnected [ 1466.899037][T23849] fido_id[23849]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 1467.173988][T20117] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1467.199486][T15942] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1467.451275][ T5890] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1467.493994][T23845] tipc: Disabling bearer [ 1467.628064][ T5890] usb 2-1: Using ep0 maxpacket: 8 [ 1467.638463][ T5890] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1467.663919][ T5890] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1467.705349][ T5890] usb 2-1: config 0 has no interface number 0 [ 1467.721596][ T5890] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1467.743393][ T5890] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1467.763142][ T5890] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1467.786822][ T5890] usb 2-1: config 0 descriptor?? [ 1467.805220][ T5890] ldusb 2-1:0.55: Interrupt in endpoint not found [ 1467.848135][ T5930] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 1467.998254][ T5930] usb 3-1: Using ep0 maxpacket: 8 [ 1468.015040][ T5930] usb 3-1: config 64 has an invalid interface number: 19 but max is 0 [ 1468.024045][ T5930] usb 3-1: config 64 has no interface number 0 [ 1468.034162][ T5930] usb 3-1: config 64 interface 19 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1468.058146][ T5930] usb 3-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=3f.e0 [ 1468.093483][T23876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1468.102911][T23876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1468.159677][ T5930] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1468.184886][ T5930] usb 3-1: probing VID:PID(2201:012C) [ 1468.196416][ T5930] usb 3-1: vub300 testing UNKNOWN EndPoint(0) 02 [ 1468.212750][ T5930] usb 3-1: vub300 ignoring EndPoint(0) 02 [ 1468.225220][ T5930] usb 3-1: Could not find two sets of bulk-in/out endpoint pairs [ 1468.247202][ T5930] vub300 3-1:64.19: probe with driver vub300 failed with error -22 [ 1468.666764][ T5905] usb 2-1: USB disconnect, device number 99 [ 1470.707897][ T5930] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1470.838601][ T130] wlan0: Trigger new scan to find an IBSS to join [ 1470.858373][ T5930] usb 2-1: Using ep0 maxpacket: 32 [ 1470.874160][ T5930] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1470.900381][ T5930] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1470.935600][ T5930] usb 2-1: config 0 descriptor?? [ 1470.954041][ T5930] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1470.977623][ T5905] usb 3-1: USB disconnect, device number 106 [ 1471.115429][ T29] kauditd_printk_skb: 20 callbacks suppressed [ 1471.115448][ T29] audit: type=1326 audit(1772952363.787:12355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.172431][ T29] audit: type=1326 audit(1772952363.787:12356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.201314][ T29] audit: type=1326 audit(1772952363.787:12357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=291 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.227606][ T29] audit: type=1326 audit(1772952363.787:12358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.262531][ T29] audit: type=1326 audit(1772952363.787:12359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.290306][ T29] audit: type=1326 audit(1772952363.787:12360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.313628][ T29] audit: type=1326 audit(1772952363.787:12361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.349820][T23925] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1471.457514][ T29] audit: type=1326 audit(1772952363.787:12362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.487242][ T29] audit: type=1326 audit(1772952363.787:12363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.511245][ T29] audit: type=1326 audit(1772952363.787:12364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23916 comm="syz.2.4358" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7e9eb9c799 code=0x7ffc0000 [ 1471.590934][T23931] binder: 23928:23931 ioctl c00c620f 200000000140 returned -22 [ 1471.869143][T15942] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1472.035291][T23919] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1472.069130][T23941] FAULT_INJECTION: forcing a failure. [ 1472.069130][T23941] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1472.087899][T23941] CPU: 0 UID: 0 PID: 23941 Comm: syz.0.4366 Tainted: G L syzkaller #0 PREEMPT(full) [ 1472.087929][T23941] Tainted: [L]=SOFTLOCKUP [ 1472.087936][T23941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1472.087947][T23941] Call Trace: [ 1472.087955][T23941] [ 1472.087963][T23941] dump_stack_lvl+0xe8/0x150 [ 1472.087992][T23941] should_fail_ex+0x412/0x560 [ 1472.088018][T23941] _copy_to_user+0x31/0xb0 [ 1472.088045][T23941] simple_read_from_buffer+0xe1/0x170 [ 1472.088073][T23941] proc_fail_nth_read+0x1bb/0x230 [ 1472.088101][T23941] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1472.088133][T23941] ? rw_verify_area+0x2a6/0x4d0 [ 1472.088150][T23941] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1472.088175][T23941] vfs_read+0x20c/0xa70 [ 1472.088201][T23941] ? __pfx_vfs_read+0x10/0x10 [ 1472.088220][T23941] ? kmem_cache_free+0x187/0x630 [ 1472.088239][T23941] ? fd_install+0x94/0x3d0 [ 1472.088260][T23941] ? do_sys_openat2+0x14c/0x200 [ 1472.088295][T23941] ksys_read+0x150/0x270 [ 1472.088316][T23941] ? __pfx_ksys_read+0x10/0x10 [ 1472.088344][T23941] do_syscall_64+0x14d/0xf80 [ 1472.088363][T23941] ? trace_irq_disable+0x3b/0x150 [ 1472.088387][T23941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1472.088405][T23941] ? clear_bhb_loop+0x40/0x90 [ 1472.088427][T23941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1472.088444][T23941] RIP: 0033:0x7fdd6db5cfce [ 1472.088462][T23941] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1472.088479][T23941] RSP: 002b:00007fdd6eb09fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1472.088499][T23941] RAX: ffffffffffffffda RBX: 00007fdd6eb0a6c0 RCX: 00007fdd6db5cfce [ 1472.088512][T23941] RDX: 000000000000000f RSI: 00007fdd6eb0a0a0 RDI: 0000000000000003 [ 1472.088524][T23941] RBP: 00007fdd6eb0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1472.088536][T23941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1472.088546][T23941] R13: 00007fdd6de16038 R14: 00007fdd6de15fa0 R15: 00007fdd6df3fa48 [ 1472.088574][T23941] [ 1472.306715][ T5930] gspca_vc032x: reg_w err -110 [ 1472.311626][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.317026][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.322405][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.327708][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.333227][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.338566][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.343897][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.349302][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.354602][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.360246][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.365570][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.371101][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.376797][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.382342][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.387623][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.393335][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.399126][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.405067][ T5930] gspca_vc032x: I2c Bus Busy Wait 00 [ 1472.415425][ T5930] gspca_vc032x: Unknown sensor... [ 1472.426780][ T5930] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 1472.440678][ T5930] usb 2-1: USB disconnect, device number 100 [ 1472.977927][ T5905] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 1473.004410][T23957] fuse: Bad value for 'fd' [ 1473.167881][ T5905] usb 4-1: Using ep0 maxpacket: 8 [ 1473.175108][ T5905] usb 4-1: config 64 has an invalid interface number: 19 but max is 0 [ 1473.198067][ T5905] usb 4-1: config 64 has no interface number 0 [ 1473.204381][ T5905] usb 4-1: config 64 interface 19 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1473.214515][ T5905] usb 4-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=3f.e0 [ 1473.223633][ T5905] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1473.242656][ T5905] usb 4-1: probing VID:PID(2201:012C) [ 1473.379886][ T5905] usb 4-1: vub300 testing UNKNOWN EndPoint(0) 02 [ 1473.386240][ T5905] usb 4-1: vub300 ignoring EndPoint(0) 02 [ 1473.406611][ T5905] usb 4-1: Could not find two sets of bulk-in/out endpoint pairs [ 1473.417870][ T5905] vub300 4-1:64.19: probe with driver vub300 failed with error -22 [ 1473.649477][T23963] dtv5100: wlen = 0, aborting. [ 1473.655931][T23963] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4373'. [ 1474.597429][T23979] FAULT_INJECTION: forcing a failure. [ 1474.597429][T23979] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1474.626595][T23979] CPU: 0 UID: 0 PID: 23979 Comm: syz.1.4376 Tainted: G L syzkaller #0 PREEMPT(full) [ 1474.626629][T23979] Tainted: [L]=SOFTLOCKUP [ 1474.626635][T23979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1474.626642][T23979] Call Trace: [ 1474.626648][T23979] [ 1474.626653][T23979] dump_stack_lvl+0xe8/0x150 [ 1474.626673][T23979] should_fail_ex+0x412/0x560 [ 1474.626689][T23979] strncpy_from_user+0x36/0x2b0 [ 1474.626704][T23979] do_getname+0x77/0x250 [ 1474.626719][T23979] __se_sys_renameat2+0x43/0x2c0 [ 1474.626734][T23979] do_syscall_64+0x14d/0xf80 [ 1474.626744][T23979] ? trace_irq_disable+0x3b/0x150 [ 1474.626766][T23979] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1474.626784][T23979] ? clear_bhb_loop+0x40/0x90 [ 1474.626806][T23979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1474.626823][T23979] RIP: 0033:0x7f583159c799 [ 1474.626841][T23979] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1474.626857][T23979] RSP: 002b:00007f58324e7028 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 1474.626876][T23979] RAX: ffffffffffffffda RBX: 00007f5831815fa0 RCX: 00007f583159c799 [ 1474.626889][T23979] RDX: ffffffffffffffff RSI: 00002000000002c0 RDI: ffffffffffffffff [ 1474.626902][T23979] RBP: 00007f58324e7090 R08: 0000000000000000 R09: 0000000000000000 [ 1474.626914][T23979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1474.626924][T23979] R13: 00007f5831816038 R14: 00007f5831815fa0 R15: 00007f583193fa48 [ 1474.626940][T23979] [ 1475.082281][T23986] FAULT_INJECTION: forcing a failure. [ 1475.082281][T23986] name failslab, interval 1, probability 0, space 0, times 0 [ 1475.095383][T23986] CPU: 1 UID: 0 PID: 23986 Comm: syz.4.4379 Tainted: G L syzkaller #0 PREEMPT(full) [ 1475.095402][T23986] Tainted: [L]=SOFTLOCKUP [ 1475.095406][T23986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1475.095412][T23986] Call Trace: [ 1475.095417][T23986] [ 1475.095422][T23986] dump_stack_lvl+0xe8/0x150 [ 1475.095442][T23986] should_fail_ex+0x412/0x560 [ 1475.095463][T23986] should_failslab+0xa8/0x100 [ 1475.095478][T23986] __kvmalloc_node_noprof+0x178/0x8a0 [ 1475.095491][T23986] ? seq_read_iter+0x202/0xe10 [ 1475.095508][T23986] seq_read_iter+0x202/0xe10 [ 1475.095524][T23986] ? __asan_memset+0x22/0x50 [ 1475.095537][T23986] seq_read+0x367/0x480 [ 1475.095552][T23986] ? __pfx_seq_read+0x10/0x10 [ 1475.095568][T23986] ? apparmor_file_permission+0x1f4/0x300 [ 1475.095583][T23986] ? __pfx_seq_read+0x10/0x10 [ 1475.095594][T23986] proc_reg_read+0x1e9/0x2e0 [ 1475.095604][T23986] ? __pfx_proc_reg_read+0x10/0x10 [ 1475.095614][T23986] vfs_read+0x20c/0xa70 [ 1475.095625][T23986] ? ksys_write+0x1e6/0x270 [ 1475.095638][T23986] ? __pfx_vfs_read+0x10/0x10 [ 1475.095649][T23986] ? __fget_files+0x2a/0x420 [ 1475.095665][T23986] ? __fget_files+0x2a/0x420 [ 1475.095678][T23986] ? __fget_files+0x3a0/0x420 [ 1475.095691][T23986] ? __fget_files+0x2a/0x420 [ 1475.095709][T23986] __x64_sys_pread64+0x199/0x230 [ 1475.095721][T23986] ? __pfx___x64_sys_pread64+0x10/0x10 [ 1475.095738][T23986] do_syscall_64+0x14d/0xf80 [ 1475.095748][T23986] ? trace_irq_disable+0x3b/0x150 [ 1475.095762][T23986] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1475.095773][T23986] ? clear_bhb_loop+0x40/0x90 [ 1475.095785][T23986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1475.095795][T23986] RIP: 0033:0x7f9d7a99c799 [ 1475.095805][T23986] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1475.095814][T23986] RSP: 002b:00007f9d7b902028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 [ 1475.095826][T23986] RAX: ffffffffffffffda RBX: 00007f9d7ac15fa0 RCX: 00007f9d7a99c799 [ 1475.095833][T23986] RDX: 0000000000000037 RSI: 0000200000001240 RDI: 0000000000000003 [ 1475.095840][T23986] RBP: 00007f9d7b902090 R08: 0000000000000000 R09: 0000000000000000 [ 1475.095846][T23986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1475.095852][T23986] R13: 00007f9d7ac16038 R14: 00007f9d7ac15fa0 R15: 00007f9d7ad3fa48 [ 1475.095867][T23986] [ 1475.336806][T23989] binder: 23982:23989 ioctl c00c620f 200000000140 returned -22 [ 1475.351857][T23991] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4381'. [ 1475.455244][T23993] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4381'. [ 1475.491349][T23995] dlm: non-version read from control device 36 [ 1475.574179][T23997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1475.582972][T23997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1476.070359][ T5905] usb 4-1: USB disconnect, device number 121 [ 1476.282131][T24001] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 1476.730263][T24009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1476.741043][T24009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1476.804478][T24009] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1476.826367][T24009] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1477.287774][T24022] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4393'. [ 1478.079291][T24037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1478.100237][T24037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1478.341812][T24039] binder: 24034:24039 ioctl c00c620f 200000000140 returned -22 [ 1478.968524][ T5930] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1479.128102][ T5930] usb 3-1: Using ep0 maxpacket: 32 [ 1479.136425][ T5930] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1479.146749][ T5930] usb 3-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 1479.157730][ T5930] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1479.176979][ T5930] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1479.186357][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1479.194755][ T5930] usb 3-1: Product: syz [ 1479.199307][ T5930] usb 3-1: Manufacturer: syz [ 1479.203934][ T5930] usb 3-1: SerialNumber: syz [ 1479.213656][ T5930] usb 3-1: config 0 descriptor?? [ 1479.625139][ T5930] gs_usb 3-1:0.0: Couldn't get device config: (err=-121) [ 1479.641800][ T5930] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -121 [ 1479.734258][T24063] FAULT_INJECTION: forcing a failure. [ 1479.734258][T24063] name failslab, interval 1, probability 0, space 0, times 0 [ 1479.747909][T24063] CPU: 1 UID: 0 PID: 24063 Comm: syz.0.4407 Tainted: G L syzkaller #0 PREEMPT(full) [ 1479.747939][T24063] Tainted: [L]=SOFTLOCKUP [ 1479.747946][T24063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1479.747956][T24063] Call Trace: [ 1479.747964][T24063] [ 1479.747972][T24063] dump_stack_lvl+0xe8/0x150 [ 1479.748000][T24063] should_fail_ex+0x412/0x560 [ 1479.748022][T24063] should_failslab+0xa8/0x100 [ 1479.748041][T24063] ? do_getname+0x2e/0x250 [ 1479.748059][T24063] kmem_cache_alloc_noprof+0x87/0x650 [ 1479.748080][T24063] do_getname+0x2e/0x250 [ 1479.748096][T24063] ? getname_flags+0x11/0x20 [ 1479.748116][T24063] do_sys_openat2+0xca/0x200 [ 1479.748138][T24063] ? __pfx_do_sys_openat2+0x10/0x10 [ 1479.748158][T24063] ? ksys_write+0x242/0x270 [ 1479.748175][T24063] ? __pfx_ksys_write+0x10/0x10 [ 1479.748192][T24063] __x64_sys_openat+0x138/0x170 [ 1479.748216][T24063] do_syscall_64+0x14d/0xf80 [ 1479.748230][T24063] ? trace_irq_disable+0x3b/0x150 [ 1479.748251][T24063] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1479.748265][T24063] ? clear_bhb_loop+0x40/0x90 [ 1479.748282][T24063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1479.748296][T24063] RIP: 0033:0x7fdd6db9c799 [ 1479.748311][T24063] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1479.748323][T24063] RSP: 002b:00007fdd6eb0a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1479.748339][T24063] RAX: ffffffffffffffda RBX: 00007fdd6de15fa0 RCX: 00007fdd6db9c799 [ 1479.748349][T24063] RDX: 0000000000000000 RSI: 0000200000000280 RDI: ffffffffffffff9c [ 1479.748359][T24063] RBP: 00007fdd6eb0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1479.748368][T24063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1479.748377][T24063] R13: 00007fdd6de16038 R14: 00007fdd6de15fa0 R15: 00007fdd6df3fa48 [ 1479.748399][T24063] [ 1479.944771][T24042] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1479.956984][T24042] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1480.007909][ T5905] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 1480.217921][ T5905] usb 2-1: Using ep0 maxpacket: 8 [ 1480.223700][ T5905] usb 2-1: no configurations [ 1480.230563][ T5905] usb 2-1: can't read configurations, error -22 [ 1480.283711][T24072] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4409'. [ 1480.356175][T24072] bond2: option lacp_active: invalid value (5) [ 1480.368043][T24072] bond2 (unregistering): Released all slaves [ 1480.377913][ T5905] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1480.410066][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 1480.410084][ T29] audit: type=1326 audit(1772952373.087:12368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.439110][ T29] audit: type=1326 audit(1772952373.087:12369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.463257][ T29] audit: type=1326 audit(1772952373.087:12370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.486617][ T29] audit: type=1326 audit(1772952373.087:12371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.534386][ T29] audit: type=1326 audit(1772952373.157:12372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.557773][ T5905] usb 2-1: Using ep0 maxpacket: 8 [ 1480.564078][ T5905] usb 2-1: no configurations [ 1480.569530][ T5905] usb 2-1: can't read configurations, error -22 [ 1480.577993][ T5905] usb usb2-port1: attempt power cycle [ 1480.584883][ T29] audit: type=1326 audit(1772952373.157:12373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=239 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.608433][ T29] audit: type=1326 audit(1772952373.157:12374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.641866][ T29] audit: type=1326 audit(1772952373.157:12375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.680609][ T29] audit: type=1326 audit(1772952373.157:12376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.720348][ T29] audit: type=1326 audit(1772952373.157:12377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24071 comm="syz.3.4409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f406bd9c799 code=0x7ffc0000 [ 1480.918062][ T5905] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 1480.938352][ T5905] usb 2-1: Using ep0 maxpacket: 8 [ 1480.944318][ T5905] usb 2-1: no configurations [ 1480.949181][ T5905] usb 2-1: can't read configurations, error -22 [ 1481.132646][ T5905] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1481.163983][ T5905] usb 2-1: Using ep0 maxpacket: 8 [ 1481.174187][ T5905] usb 2-1: no configurations [ 1481.183306][ T5905] usb 2-1: can't read configurations, error -22 [ 1481.195712][ T5905] usb usb2-port1: unable to enumerate USB device [ 1481.420656][T24084] binder: 24079:24084 ioctl 4018620d 0 returned -22 [ 1481.432281][T24084] binder: 24079:24084 ioctl c0306201 2000000003c0 returned -22 [ 1481.650197][ T5930] usb 3-1: USB disconnect, device number 107 [ 1481.675042][T24086] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4412'. [ 1481.692602][ T5828] Bluetooth: hci3: unexpected event 0x2f length: 509 > 260 [ 1481.834382][T24094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1481.857388][T24092] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4415'. [ 1481.867323][T24094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1482.277954][ T5930] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 1482.427916][ T5930] usb 3-1: Using ep0 maxpacket: 16 [ 1482.439548][ T5930] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1482.454014][ T5930] usb 3-1: config 13 has an invalid interface number: 50 but max is 0 [ 1482.467121][ T5930] usb 3-1: config 13 has no interface number 0 [ 1482.487567][ T5930] usb 3-1: config 13 interface 50 altsetting 167 bulk endpoint 0x88 has invalid maxpacket 16 [ 1482.517045][ T5930] usb 3-1: config 13 interface 50 has no altsetting 0 [ 1482.527241][ T5930] usb 3-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 1482.537036][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1482.545328][T24101] snd_dummy snd_dummy.0: control 3:5:3:syz1:9 is already present [ 1482.545517][ T5930] usb 3-1: Product: syz [ 1482.558900][ T5930] usb 3-1: Manufacturer: syz [ 1482.563528][ T5930] usb 3-1: SerialNumber: syz [ 1482.580484][T24096] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1482.613361][T24104] FAULT_INJECTION: forcing a failure. [ 1482.613361][T24104] name failslab, interval 1, probability 0, space 0, times 0 [ 1482.628621][T24104] CPU: 1 UID: 0 PID: 24104 Comm: syz.4.4419 Tainted: G L syzkaller #0 PREEMPT(full) [ 1482.628652][T24104] Tainted: [L]=SOFTLOCKUP [ 1482.628659][T24104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1482.628670][T24104] Call Trace: [ 1482.628677][T24104] [ 1482.628685][T24104] dump_stack_lvl+0xe8/0x150 [ 1482.628716][T24104] should_fail_ex+0x412/0x560 [ 1482.628743][T24104] should_failslab+0xa8/0x100 [ 1482.628768][T24104] __kmalloc_noprof+0xe8/0x760 [ 1482.628788][T24104] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1482.628819][T24104] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1482.628852][T24104] ? tomoyo_path_number_perm+0x219/0x630 [ 1482.628872][T24104] tomoyo_path_number_perm+0x246/0x630 [ 1482.628895][T24104] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1482.628918][T24104] ? __lock_acquire+0x6b5/0x2cf0 [ 1482.628950][T24104] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1482.628992][T24104] ? __fget_files+0x2a/0x420 [ 1482.629019][T24104] ? __fget_files+0x2a/0x420 [ 1482.629041][T24104] ? __fget_files+0x3a0/0x420 [ 1482.629063][T24104] ? __fget_files+0x2a/0x420 [ 1482.629091][T24104] security_file_ioctl+0xc3/0x2a0 [ 1482.629112][T24104] __se_sys_ioctl+0x47/0x170 [ 1482.629135][T24104] do_syscall_64+0x14d/0xf80 [ 1482.629151][T24104] ? trace_irq_disable+0x3b/0x150 [ 1482.629175][T24104] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1482.629194][T24104] ? clear_bhb_loop+0x40/0x90 [ 1482.629216][T24104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1482.629233][T24104] RIP: 0033:0x7f9d7a99c799 [ 1482.629250][T24104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1482.629266][T24104] RSP: 002b:00007f9d7b902028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1482.629285][T24104] RAX: ffffffffffffffda RBX: 00007f9d7ac15fa0 RCX: 00007f9d7a99c799 [ 1482.629298][T24104] RDX: 0000200000000040 RSI: 00000000c0405602 RDI: 0000000000000003 [ 1482.629309][T24104] RBP: 00007f9d7b902090 R08: 0000000000000000 R09: 0000000000000000 [ 1482.629319][T24104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1482.629328][T24104] R13: 00007f9d7ac16038 R14: 00007f9d7ac15fa0 R15: 00007f9d7ad3fa48 [ 1482.629354][T24104] [ 1482.629382][T24104] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1482.867929][ T5905] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 1483.020795][ T5930] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1483.028116][ T798] usb 2-1: new full-speed USB device number 105 using dummy_hcd [ 1483.034630][ T5905] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1483.087992][ T5905] usb 4-1: can't read configurations, error -22 [ 1483.128116][ T5930] usb 3-1: MIDIStreaming interface descriptor not found [ 1483.160699][T20117] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1483.190446][ T798] usb 2-1: config 0 has an invalid interface number: 11 but max is 0 [ 1483.209027][ T5930] usb 3-1: USB disconnect, device number 108 [ 1483.217357][ T798] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1483.242259][ T5905] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 1483.242286][ T798] usb 2-1: config 0 has no interface number 0 [ 1483.260330][ T798] usb 2-1: config 0 interface 11 altsetting 253 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1483.275396][ T798] usb 2-1: config 0 interface 11 has no altsetting 0 [ 1483.283570][ T798] usb 2-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 1483.295097][ T798] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1483.401282][ T798] usb 2-1: config 0 descriptor?? [ 1483.423240][ T798] keyspan 2-1:0.11: Keyspan 2 port adapter converter detected [ 1483.431069][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 87 [ 1483.439483][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 7 [ 1483.450940][ T5905] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1483.451813][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 81 [ 1483.472544][ T5905] usb 4-1: can't read configurations, error -22 [ 1483.480124][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 82 [ 1483.485434][ T5905] usb usb4-port1: attempt power cycle [ 1483.488095][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 1 [ 1483.504877][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 2 [ 1483.515006][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 85 [ 1483.523065][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 5 [ 1483.551153][ T798] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1483.561610][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 83 [ 1483.571496][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 84 [ 1483.579791][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 3 [ 1483.592709][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 4 [ 1483.600751][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 86 [ 1483.611127][ T798] keyspan 2-1:0.11: found no endpoint descriptor for endpoint 6 [ 1483.635556][T24099] netlink: 'syz.1.4417': attribute type 3 has an invalid length. [ 1483.644685][ T798] usb 2-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1483.837996][ T5905] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 1484.021213][T24120] binder: 24114:24120 ioctl c00c620f 200000000140 returned -22 [ 1484.049963][ T5905] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1484.058211][ T5905] usb 4-1: can't read configurations, error -22 [ 1484.198122][ T5905] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 1484.220752][ T5905] usb 4-1: config index 0 descriptor too short (expected 9, got 0) [ 1484.223054][ T798] usb 2-1: USB disconnect, device number 105 [ 1484.234963][ T5905] usb 4-1: can't read configurations, error -22 [ 1484.246882][ T798] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1484.251435][ T5905] usb usb4-port1: unable to enumerate USB device [ 1484.272651][ T798] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1484.292837][ T798] keyspan 2-1:0.11: device disconnected [ 1484.442019][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.448383][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1486.005954][ T798] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 1486.128900][T24147] dtv5100: wlen = 0, aborting. [ 1486.147363][T24146] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4430'. [ 1486.156478][ T5930] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 1486.264142][ T798] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 1486.275271][ T798] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1486.291497][ T798] usb 3-1: New USB device found, idVendor=1b5c, idProduct=0105, bcdDevice= 1.f1 [ 1486.305644][ T798] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1486.315374][ T798] usb 3-1: Product: syz [ 1486.319875][ T798] usb 3-1: Manufacturer: syz [ 1486.324693][ T798] usb 3-1: SerialNumber: syz [ 1486.344244][ T798] usb 3-1: config 0 descriptor?? [ 1486.355405][ T798] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 1486.378295][ T798] usb 3-1: Detected SIO [ 1486.383316][ T798] ftdi_sio ttyUSB0: Overriding wMaxPacketSize on endpoint 4 [ 1486.391375][ T5930] usb 2-1: Using ep0 maxpacket: 8 [ 1486.397089][ T5930] usb 2-1: no configurations [ 1486.402804][ T5930] usb 2-1: can't read configurations, error -22 [ 1486.412521][ T798] ftdi_sio ttyUSB0: Overriding wMaxPacketSize on endpoint 7 [ 1486.430638][ T798] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1486.547914][ T5930] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 1486.587988][ T5905] usb 3-1: USB disconnect, device number 109 [ 1486.648303][ T5905] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1486.661672][ T5905] ftdi_sio 3-1:0.0: device disconnected [ 1486.717978][ T5930] usb 2-1: Using ep0 maxpacket: 8 [ 1486.723623][ T5930] usb 2-1: no configurations [ 1486.728731][ T5930] usb 2-1: can't read configurations, error -22 [ 1486.735345][ T5930] usb usb2-port1: attempt power cycle [ 1487.078538][ T5930] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 1487.098590][ T5930] usb 2-1: Using ep0 maxpacket: 8 [ 1487.104203][ T5930] usb 2-1: no configurations [ 1487.109288][ T5930] usb 2-1: can't read configurations, error -22 [ 1487.838387][ T5930] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 1487.868497][ T5930] usb 2-1: Using ep0 maxpacket: 8 [ 1487.880203][ T5930] usb 2-1: no configurations [ 1487.890615][ T5930] usb 2-1: can't read configurations, error -22 [ 1487.903089][ T5930] usb usb2-port1: unable to enumerate USB device [ 1488.042537][T24157] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1488.054410][T24157] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1488.064669][T24157] dtv5100: wlen = 0, aborting. [ 1488.698109][ T5828] Bluetooth: hci3: unexpected event 0x2f length: 509 > 260 [ 1488.705142][T24161] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4434'. [ 1488.723383][T24161] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4434'. [ 1488.732469][T24161] netlink: 'syz.1.4434': attribute type 19 has an invalid length. [ 1488.741513][T24161] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4434'. [ 1490.560057][ T5930] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 1490.944120][ T5930] usb 3-1: Using ep0 maxpacket: 32 [ 1491.019845][ T5930] usb 3-1: config 0 has an invalid interface number: 4 but max is 0 [ 1491.174558][ T5930] usb 3-1: config 0 has no interface number 0 [ 1491.196723][ T5930] usb 3-1: config 0 interface 4 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1491.219208][ T5930] usb 3-1: config 0 interface 4 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1491.230579][ T5930] usb 3-1: config 0 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1491.463563][ T5930] usb 3-1: New USB device found, idVendor=046d, idProduct=c537, bcdDevice= 0.00 [ 1491.483699][ T5930] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1491.529075][ T5930] usb 3-1: config 0 descriptor?? [ 1491.662194][T24199] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1491.688225][T24199] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1492.016318][ T5930] logitech-djreceiver 0003:046D:C537.002A: hidraw0: USB HID v10.00 Device [HID 046d:c537] on usb-dummy_hcd.2-1/input4 [ 1492.231250][ T5930] usb 3-1: USB disconnect, device number 110 [ 1492.256828][T24215] syzkaller0: entered promiscuous mode [ 1492.262466][T24215] syzkaller0: entered allmulticast mode [ 1492.587311][ T5828] Bluetooth: hci1: unexpected event 0x2f length: 509 > 260 [ 1492.798446][ T5905] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 1493.032328][T24227] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4449'. [ 1493.067926][ T5905] usb 4-1: device descriptor read/64, error -71 [ 1493.080285][T24227] macsec2: entered promiscuous mode [ 1493.097137][T24227] bridge0: entered promiscuous mode [ 1493.102524][T24227] macsec2: entered allmulticast mode [ 1493.118119][T24227] bridge0: entered allmulticast mode [ 1493.309911][ T5905] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 1493.429522][T24231] netlink: 'syz.4.4450': attribute type 4 has an invalid length. [ 1493.448061][ T5905] usb 4-1: device descriptor read/64, error -71 [ 1493.454616][T24231] netlink: 17 bytes leftover after parsing attributes in process `syz.4.4450'. [ 1493.558156][ T5905] usb usb4-port1: attempt power cycle [ 1493.941719][ T5905] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 1494.651899][ T5905] usb 4-1: device descriptor read/8, error -71 [ 1494.722319][T24243] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4452'. [ 1494.731509][T24243] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4452'. [ 1494.755425][T24243] netlink: 'syz.1.4452': attribute type 19 has an invalid length. [ 1494.772465][T24243] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4452'. [ 1494.960450][ T5905] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 1495.062626][ T5905] usb 4-1: device descriptor read/8, error -71 [ 1495.186355][ T5905] usb usb4-port1: unable to enumerate USB device [ 1495.366691][T24255] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1495.927946][ T5890] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 1496.085958][ T5890] usb 3-1: Using ep0 maxpacket: 32 [ 1496.103732][ T5890] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 52, changing to 9 [ 1496.135515][ T5890] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 8241, setting to 1024 [ 1496.165895][ T5890] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 1496.177365][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1496.189535][ T5890] usb 3-1: Product: syz [ 1496.200482][ T5890] usb 3-1: Manufacturer: syz [ 1496.205763][T24270] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4462'. [ 1496.288956][ T5890] usb 3-1: SerialNumber: syz [ 1496.297218][ T5890] usb 3-1: config 0 descriptor?? [ 1496.332480][ T5890] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1496.515794][T24262] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4457'. [ 1496.528877][T24262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1496.538395][T24262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1496.920840][T22766] usb 3-1: Failed to submit usb control message: -71 [ 1496.935040][T22766] usb 3-1: unable to send the bmi data to the device: -71 [ 1496.942894][ T5930] usb 3-1: USB disconnect, device number 111 [ 1496.963068][T22766] usb 3-1: unable to get target info from device [ 1496.982460][T22766] usb 3-1: could not get target info (-71) [ 1497.000664][T22766] usb 3-1: could not probe fw (-71) [ 1497.173744][T24286] syzkaller0: entered promiscuous mode [ 1497.179488][T24286] syzkaller0: entered allmulticast mode [ 1497.350523][T24288] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4465'. [ 1497.364799][T24288] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4465'. [ 1497.994046][T24304] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1498.003332][T24304] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1498.013202][T24302] dtv5100: wlen = 0, aborting. [ 1498.019563][T24302] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4468'. [ 1499.158064][T22766] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1499.168531][ T35] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1500.011404][T24324] bridge0: left allmulticast mode [ 1500.115297][T24324] bridge0: left promiscuous mode [ 1500.567904][ T5890] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 1500.605437][T24340] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4479'. [ 1500.736976][T24340] bridge32: port 1(veth11) entered blocking state [ 1500.743621][T24340] bridge32: port 1(veth11) entered disabled state [ 1500.752674][T24340] veth11: entered allmulticast mode [ 1500.761001][T24340] veth11: entered promiscuous mode [ 1500.767960][T24339] veth0_to_bond: left allmulticast mode [ 1500.773546][T24339] veth0_to_bond: left promiscuous mode [ 1500.788925][T24339] bridge28: port 2(veth0_to_bond) entered disabled state [ 1500.797928][ T5890] usb 4-1: Using ep0 maxpacket: 8 [ 1500.827242][T24339] bridge32: port 2(veth0_to_bond) entered blocking state [ 1500.836179][T24339] bridge32: port 2(veth0_to_bond) entered disabled state [ 1500.847299][T24339] veth0_to_bond: entered allmulticast mode [ 1500.854257][ T5890] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 1500.856135][T24339] veth0_to_bond: entered promiscuous mode [ 1500.905960][ T5890] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1500.928249][ T5828] Bluetooth: hci1: unexpected event 0x2f length: 509 > 260 [ 1500.961606][T24341] bridge32: port 3(veth13) entered blocking state [ 1500.977193][ T5890] usb 4-1: Product: syz [ 1500.977273][T24341] bridge32: port 3(veth13) entered disabled state [ 1501.017055][T24341] veth13: entered allmulticast mode [ 1501.045734][ T5890] usb 4-1: Manufacturer: syz [ 1501.053273][ T5890] usb 4-1: SerialNumber: syz [ 1501.102207][ T5890] usb 4-1: config 0 descriptor?? [ 1501.125054][ T5890] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 1501.133655][T24341] veth13: entered promiscuous mode [ 1501.143315][ T5890] pctv452e: pctv452e_power_ctrl: 1 [ 1501.143315][ T5890] [ 1501.179338][ T5890] usb 4-1: selecting invalid altsetting 3 [ 1501.185110][ T5890] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 1501.185110][ T5890] [ 1501.197959][ T5890] dvb-usb: bulk message failed: -22 (5/0) [ 1501.232441][ T5890] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1501.253518][ T5890] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 1501.263930][ T5890] usb 4-1: media controller created [ 1501.277585][ T5890] dvb-usb: bulk message failed: -22 (8/0) [ 1501.285899][ T5890] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 1501.294510][ T5890] dvb-usb: MAC address reading failed. [ 1501.330391][T24336] dtv5100: wlen = 0, aborting. [ 1501.336927][T24336] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4478'. [ 1501.400561][ T5890] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1501.932801][ T5890] DVB: Unable to find symbol stb0899_attach() [ 1501.939901][ T5890] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 1502.047913][ T5890] rc_core: IR keymap rc-tt-1500 not found [ 1502.054224][ T5890] Registered IR keymap rc-empty [ 1502.062770][ T5890] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 1502.080239][ T5890] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input147 [ 1502.092703][ T5890] dvb-usb: schedule remote query interval to 100 msecs. [ 1502.103715][ T5890] pctv452e: pctv452e_power_ctrl: 0 [ 1502.103715][ T5890] [ 1502.118941][ T5890] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 1502.207944][ T5905] dvb-usb: bulk message failed: -22 (4/0) [ 1502.213770][ T5905] dvb-usb: error -22 while querying for an remote control event. [ 1502.430929][ T5905] dvb-usb: bulk message failed: -22 (4/0) [ 1502.436694][ T5905] dvb-usb: error -22 while querying for an remote control event. [ 1502.598153][ T5890] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1502.613326][ T5905] dvb-usb: bulk message failed: -22 (4/0) [ 1502.620319][ T5905] dvb-usb: error -22 while querying for an remote control event. [ 1502.748401][ T5905] dvb-usb: bulk message failed: -22 (4/0) [ 1502.754469][ T5905] dvb-usb: error -22 while querying for an remote control event. [ 1502.778130][ T5890] usb 3-1: Using ep0 maxpacket: 8 [ 1502.785975][ T5890] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1502.796496][ T5890] usb 3-1: config 0 has no interface number 0 [ 1502.805775][ T5890] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1502.819960][ T5890] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1502.834961][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1502.851928][ T5890] usb 3-1: config 0 descriptor?? [ 1502.868216][ T5905] dvb-usb: bulk message failed: -22 (4/0) [ 1502.874257][ T5905] dvb-usb: error -22 while querying for an remote control event. [ 1502.884113][ T5890] iowarrior 3-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1502.988294][ T5890] dvb-usb: bulk message failed: -22 (4/0) [ 1503.020171][ T5890] dvb-usb: error -22 while querying for an remote control event. [ 1503.040731][ T5905] usb 4-1: USB disconnect, device number 4 [ 1503.175958][T24369] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1503.185057][T24369] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1503.251582][T24377] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1503.343864][ T5905] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 1503.357176][T24369] dtv5100: wlen = 0, aborting. [ 1504.279430][T15942] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1505.567046][ T5828] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 1505.571525][ T5828] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 1505.826168][ T5930] usb 3-1: USB disconnect, device number 112 [ 1507.124292][T24434] binder: 24433:24434 ioctl c0306201 0 returned -14 [ 1507.133819][T24434] binder: BINDER_SET_CONTEXT_MGR already set [ 1507.140091][T24434] binder: 24433:24434 ioctl 4018620d 200000000040 returned -16 [ 1507.698706][ T5905] usb 2-1: new full-speed USB device number 110 using dummy_hcd [ 1508.023042][ T5905] usb 2-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1508.033714][ T5905] usb 2-1: config 8 has 0 interfaces, different from the descriptor's value: 1 [ 1508.043197][ T5905] usb 2-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1508.074667][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1508.914739][T24465] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1509.125784][T24470] FAULT_INJECTION: forcing a failure. [ 1509.125784][T24470] name failslab, interval 1, probability 0, space 0, times 0 [ 1509.149224][T24470] CPU: 1 UID: 0 PID: 24470 Comm: syz.0.4510 Tainted: G L syzkaller #0 PREEMPT(full) [ 1509.149254][T24470] Tainted: [L]=SOFTLOCKUP [ 1509.149262][T24470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1509.149272][T24470] Call Trace: [ 1509.149280][T24470] [ 1509.149289][T24470] dump_stack_lvl+0xe8/0x150 [ 1509.149320][T24470] should_fail_ex+0x412/0x560 [ 1509.149345][T24470] should_failslab+0xa8/0x100 [ 1509.149365][T24470] ? skb_clone+0x212/0x3a0 [ 1509.149382][T24470] kmem_cache_alloc_noprof+0x87/0x650 [ 1509.149399][T24470] ? apparmor_capable+0x126/0x170 [ 1509.149510][T24470] skb_clone+0x212/0x3a0 [ 1509.149520][T24470] ? nfnetlink_rcv+0x4b0/0x27b0 [ 1509.149548][T24470] nfnetlink_rcv+0x4e2/0x27b0 [ 1509.149559][T24470] ? is_bpf_text_address+0x26/0x2b0 [ 1509.149573][T24470] ? is_bpf_text_address+0x292/0x2b0 [ 1509.149583][T24470] ? is_bpf_text_address+0x26/0x2b0 [ 1509.149597][T24470] ? __kernel_text_address+0xd/0x30 [ 1509.149609][T24470] ? unwind_get_return_address+0x4d/0x90 [ 1509.149624][T24470] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1509.149636][T24470] ? arch_stack_walk+0xfb/0x150 [ 1509.149655][T24470] ? __lock_acquire+0x6b5/0x2cf0 [ 1509.149668][T24470] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1509.149685][T24470] ? __lock_acquire+0x6b5/0x2cf0 [ 1509.149701][T24470] ? __lock_acquire+0x6b5/0x2cf0 [ 1509.149716][T24470] ? __netlink_lookup+0xc6/0x8b0 [ 1509.149733][T24470] ? __netlink_lookup+0x7e4/0x8b0 [ 1509.149751][T24470] ? netlink_deliver_tap+0x2e/0x1b0 [ 1509.149772][T24470] netlink_unicast+0x80f/0x9b0 [ 1509.149788][T24470] ? __pfx_netlink_unicast+0x10/0x10 [ 1509.149801][T24470] ? netlink_sendmsg+0x650/0xb40 [ 1509.149813][T24470] ? skb_put+0x11b/0x210 [ 1509.149828][T24470] netlink_sendmsg+0x813/0xb40 [ 1509.149846][T24470] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1509.149860][T24470] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1509.149874][T24470] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1509.149887][T24470] ____sys_sendmsg+0x972/0x9f0 [ 1509.149902][T24470] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1509.149916][T24470] ? import_iovec+0x73/0xa0 [ 1509.149933][T24470] ___sys_sendmsg+0x2a5/0x360 [ 1509.149945][T24470] ? __pfx____sys_sendmsg+0x10/0x10 [ 1509.149971][T24470] ? __fget_files+0x2a/0x420 [ 1509.149986][T24470] ? __fget_files+0x3a0/0x420 [ 1509.150009][T24470] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1509.150023][T24470] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1509.150045][T24470] ? __pfx_ksys_write+0x10/0x10 [ 1509.150073][T24470] do_syscall_64+0x14d/0xf80 [ 1509.150088][T24470] ? trace_irq_disable+0x3b/0x150 [ 1509.150112][T24470] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1509.150131][T24470] ? clear_bhb_loop+0x40/0x90 [ 1509.150150][T24470] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1509.150160][T24470] RIP: 0033:0x7fdd6db9c799 [ 1509.150171][T24470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1509.150180][T24470] RSP: 002b:00007fdd6eb0a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1509.150192][T24470] RAX: ffffffffffffffda RBX: 00007fdd6de15fa0 RCX: 00007fdd6db9c799 [ 1509.150199][T24470] RDX: 0000000000000040 RSI: 0000200000009b40 RDI: 0000000000000003 [ 1509.150206][T24470] RBP: 00007fdd6eb0a090 R08: 0000000000000000 R09: 0000000000000000 [ 1509.150212][T24470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1509.150218][T24470] R13: 00007fdd6de16038 R14: 00007fdd6de15fa0 R15: 00007fdd6df3fa48 [ 1509.150233][T24470] [ 1509.878735][ T35] wlan0: Trigger new scan to find an IBSS to join [ 1510.483922][T24483] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4515'. [ 1510.648475][T24490] fuse: Invalid uid '00000000000000000004' [ 1511.550154][ T5930] usb 2-1: USB disconnect, device number 110 [ 1512.248011][ T798] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 1512.454244][ T798] usb 4-1: config 0 has an invalid interface number: 255 but max is 0 [ 1512.462559][ T798] usb 4-1: config 0 has no interface number 0 [ 1512.698953][ T798] usb 4-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 1512.712876][ T798] usb 4-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1512.727722][ T798] usb 4-1: config 0 interface 255 has no altsetting 0 [ 1512.737218][ T798] usb 4-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 1512.795318][ T798] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1512.838005][T15942] wlan0: Trigger new scan to find an IBSS to join [ 1512.842087][ T798] usb 4-1: config 0 descriptor?? [ 1512.890862][ T798] ums-realtek 4-1:0.255: USB Mass Storage device detected [ 1513.348166][ T798] usb 4-1: USB disconnect, device number 5 [ 1513.939817][T24534] FAULT_INJECTION: forcing a failure. [ 1513.939817][T24534] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1513.960353][T24534] CPU: 1 UID: 0 PID: 24534 Comm: syz.4.4524 Tainted: G L syzkaller #0 PREEMPT(full) [ 1513.960381][T24534] Tainted: [L]=SOFTLOCKUP [ 1513.960385][T24534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1513.960391][T24534] Call Trace: [ 1513.960395][T24534] [ 1513.960401][T24534] dump_stack_lvl+0xe8/0x150 [ 1513.960421][T24534] should_fail_ex+0x412/0x560 [ 1513.960438][T24534] _copy_to_user+0x31/0xb0 [ 1513.960454][T24534] simple_read_from_buffer+0xe1/0x170 [ 1513.960471][T24534] proc_fail_nth_read+0x1bb/0x230 [ 1513.960488][T24534] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1513.960503][T24534] ? rw_verify_area+0x2a6/0x4d0 [ 1513.960514][T24534] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1513.960528][T24534] vfs_read+0x20c/0xa70 [ 1513.960538][T24534] ? fdget_pos+0x246/0x320 [ 1513.960554][T24534] ? __pfx___mutex_lock+0x10/0x10 [ 1513.960565][T24534] ? __pfx_vfs_read+0x10/0x10 [ 1513.960577][T24534] ? __fget_files+0x2a/0x420 [ 1513.960594][T24534] ? __fget_files+0x3a0/0x420 [ 1513.960609][T24534] ? __fget_files+0x2a/0x420 [ 1513.960627][T24534] ksys_read+0x150/0x270 [ 1513.960639][T24534] ? __pfx_ksys_read+0x10/0x10 [ 1513.960654][T24534] do_syscall_64+0x14d/0xf80 [ 1513.960664][T24534] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.960674][T24534] ? clear_bhb_loop+0x40/0x90 [ 1513.960686][T24534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.960696][T24534] RIP: 0033:0x7f9d7a95cfce [ 1513.960707][T24534] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1513.960715][T24534] RSP: 002b:00007f9d7b8bffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1513.960727][T24534] RAX: ffffffffffffffda RBX: 00007f9d7b8c06c0 RCX: 00007f9d7a95cfce [ 1513.960735][T24534] RDX: 000000000000000f RSI: 00007f9d7b8c00a0 RDI: 0000000000000009 [ 1513.960741][T24534] RBP: 00007f9d7b8c0090 R08: 0000000000000000 R09: 0000000000000000 [ 1513.960748][T24534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1513.960753][T24534] R13: 00007f9d7ac16218 R14: 00007f9d7ac16180 R15: 00007f9d7ad3fa48 [ 1513.960769][T24534] [ 1514.406039][T24546] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1514.469580][T24545] binder: 24540:24545 ioctl c00c620f 200000000140 returned -22 [ 1514.588653][ T5905] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 1514.740182][ T5905] usb 4-1: Using ep0 maxpacket: 32 [ 1514.754382][ T5905] usb 4-1: config 0 has an invalid interface number: 4 but max is 0 [ 1514.765366][ T5905] usb 4-1: config 0 has no interface number 0 [ 1514.777129][ T5905] usb 4-1: config 0 interface 4 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1514.806755][ T5905] usb 4-1: config 0 interface 4 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1514.824856][ T5905] usb 4-1: config 0 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1514.849219][ T5905] usb 4-1: New USB device found, idVendor=046d, idProduct=c537, bcdDevice= 0.00 [ 1514.866390][ T5905] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1514.890922][ T5905] usb 4-1: config 0 descriptor?? [ 1515.353855][ T5905] logitech-djreceiver 0003:046D:C537.002B: hidraw0: USB HID v10.00 Device [HID 046d:c537] on usb-dummy_hcd.3-1/input4 [ 1515.570865][ T798] usb 4-1: USB disconnect, device number 6 [ 1515.673686][T24559] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4532'. [ 1515.723687][T24559] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4532'. [ 1515.768705][T24559] netlink: 'syz.4.4532': attribute type 19 has an invalid length. [ 1515.780509][T24559] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4532'. [ 1516.129548][T24573] fuse: Bad value for 'fd' [ 1516.846896][ T35] wlan0: Trigger new scan to find an IBSS to join [ 1517.074243][T24591] team0: Device gtp0 is of different type [ 1517.187940][ T5905] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 1517.202291][T24604] binder: 24597:24604 ioctl c00c620f 200000000140 returned -22 [ 1517.348607][ T5905] usb 3-1: Using ep0 maxpacket: 32 [ 1517.355761][ T5905] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 52, changing to 9 [ 1517.371019][ T5905] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 8241, setting to 1024 [ 1517.385479][ T5905] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 1517.395069][ T5905] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1517.432091][ T5905] usb 3-1: Product: syz [ 1517.452184][ T5905] usb 3-1: Manufacturer: syz [ 1517.465530][ T5905] usb 3-1: SerialNumber: syz [ 1517.489689][ T5905] usb 3-1: config 0 descriptor?? [ 1517.535705][ T5905] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1517.723123][T24594] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4541'. [ 1517.951632][ T1340] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1517.963046][T24610] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1518.020351][T24610] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1518.560913][ T130] usb 3-1: Failed to submit usb control message: -71 [ 1518.561282][ T5905] usb 3-1: USB disconnect, device number 113 [ 1518.578421][ T130] usb 3-1: unable to send the bmi data to the device: -71 [ 1518.596871][ T130] usb 3-1: unable to get target info from device [ 1518.620050][ T130] usb 3-1: could not get target info (-71) [ 1518.644735][ T130] usb 3-1: could not probe fw (-71) [ 1518.710336][T24618] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4546'. [ 1518.772564][T24618] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4546'. [ 1518.785112][T24618] netlink: 'syz.4.4546': attribute type 19 has an invalid length. [ 1518.817175][T24618] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4546'. [ 1519.023392][T24624] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1519.079700][T24624] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1519.146710][T24624] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4548'. [ 1519.200522][T24628] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1519.209568][T24628] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1519.845881][T24634] xt_policy: neither incoming nor outgoing policy selected [ 1520.750015][T24652] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4555'. [ 1520.759250][T24652] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4555'. [ 1520.771735][T24652] netlink: 'syz.3.4555': attribute type 19 has an invalid length. [ 1521.077623][T24652] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4555'. [ 1521.302570][T24656] binder: 24653:24656 ioctl c00c620f 200000000140 returned -22 [ 1521.967088][ T5828] Bluetooth: hci1: unexpected event 0x2f length: 509 > 260 [ 1522.334005][T24676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1522.361449][T24676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1522.841449][ T130] wlan0: Trigger new scan to find an IBSS to join [ 1524.609639][T24715] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4570'. [ 1524.620871][T24715] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4570'. [ 1524.640395][T24715] netlink: 'syz.4.4570': attribute type 19 has an invalid length. [ 1524.648428][T24715] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4570'. [ 1525.290113][T24727] binder: BINDER_SET_CONTEXT_MGR already set [ 1525.296140][T24727] binder: 24717:24727 ioctl 4018620d 200000000040 returned -16 [ 1525.757908][ T5890] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 1525.917946][ T5890] usb 3-1: Using ep0 maxpacket: 32 [ 1525.925524][ T5890] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 1525.953723][ T5890] usb 3-1: config 0 has no interface number 0 [ 1525.965081][ T5890] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1525.977962][ T5956] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 1525.989508][ T5890] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1525.999779][ T5890] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1526.037237][ T5890] usb 3-1: Product: syz [ 1526.062386][ T5890] usb 3-1: Manufacturer: syz [ 1526.067064][ T5890] usb 3-1: SerialNumber: syz [ 1526.076140][ T5890] usb 3-1: config 0 descriptor?? [ 1526.085441][ T5890] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1526.096003][ T5890] em28xx 3-1:0.132: Video interface 132 found: [ 1526.149526][ T5956] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 34, using maximum allowed: 30 [ 1526.160638][ T5956] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1526.327908][ T5956] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1526.359169][ T5956] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 34 [ 1526.384626][ T5956] usb 2-1: New USB device found, idVendor=056a, idProduct=0131, bcdDevice= 0.00 [ 1526.408122][ T5890] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 1526.415929][ T5956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1526.445161][ T5956] usb 2-1: config 0 descriptor?? [ 1526.673912][T24744] binder: 24741:24744 ioctl c00c620f 200000000140 returned -22 [ 1526.693615][ T5890] em28xx 3-1:0.132: failed to get i2c transfer status from bridge register (error=-5) [ 1526.703519][ T5890] em28xx 3-1:0.132: board has no eeprom [ 1526.797879][ T5890] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1526.805911][ T5890] em28xx 3-1:0.132: analog set to bulk mode. [ 1526.825428][ T5905] em28xx 3-1:0.132: Registering V4L2 extension [ 1526.838100][ T130] wlan0: Trigger new scan to find an IBSS to join [ 1526.869536][T24733] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1526.913404][T24733] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1526.999601][ T5956] wacom 0003:056A:0131.002C: Unknown device_type for 'HID 056a:0131'. Ignoring. [ 1527.172916][ T5905] em28xx 3-1:0.132: failed to get i2c transfer status from bridge register (error=-5) [ 1527.219896][ T5956] usb 2-1: USB disconnect, device number 111 [ 1527.235423][ T798] usb 3-1: USB disconnect, device number 114 [ 1527.278256][ T798] em28xx 3-1:0.132: Disconnecting em28xx [ 1527.372288][T24755] binder: BINDER_SET_CONTEXT_MGR already set [ 1527.378448][T24755] binder: 24748:24755 ioctl 4018620d 200000000040 returned -16 [ 1527.573865][ T5905] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 1527.581424][ T5905] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 1527.588716][ T5905] em28xx 3-1:0.132: No AC97 audio processor [ 1527.605256][ T5905] usb 3-1: Decoder not found [ 1527.611122][ T5905] em28xx 3-1:0.132: failed to create media graph [ 1527.617518][ T5905] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 1527.627186][ T5905] em28xx 3-1:0.132: Remote control support is not available for this card. [ 1527.635940][ T798] em28xx 3-1:0.132: Closing input extension [ 1527.730147][ T798] em28xx 3-1:0.132: Freeing device [ 1527.900030][ T130] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1528.247905][ T5905] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 1528.408417][ T5905] usb 3-1: Using ep0 maxpacket: 32 [ 1528.435303][ T5905] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 52, changing to 9 [ 1528.447909][ T5905] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 8241, setting to 1024 [ 1528.463756][ T5905] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 1528.483424][ T5905] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1528.511798][ T5905] usb 3-1: Product: syz [ 1528.523926][ T5905] usb 3-1: Manufacturer: syz [ 1528.539675][ T5905] usb 3-1: SerialNumber: syz [ 1528.566964][ T5905] usb 3-1: config 0 descriptor?? [ 1528.622323][ T5905] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1528.805891][T24762] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4580'. [ 1528.894184][T24762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1528.910108][T24762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1529.046022][ T1340] usb 3-1: Failed to submit usb control message: -71 [ 1529.053450][ T1340] usb 3-1: unable to send the bmi data to the device: -71 [ 1529.061429][ T5956] usb 3-1: USB disconnect, device number 115 [ 1529.128613][ T1340] usb 3-1: unable to get target info from device [ 1529.151745][ T1340] usb 3-1: could not get target info (-71) [ 1529.195653][ T1340] usb 3-1: could not probe fw (-71) [ 1529.322185][T24786] fuse: Bad value for 'fd' [ 1529.755362][T24789] binder: 24788:24789 ioctl c0306201 2000000003c0 returned -22 [ 1529.947922][ T5956] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1530.097894][ T5956] usb 3-1: Using ep0 maxpacket: 32 [ 1530.105115][ T5956] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1530.125235][ T5956] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1530.144717][ T5956] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1530.178416][ T5956] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 1530.192583][ T5956] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 1530.395505][ T5956] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1530.999269][ T5956] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.025015][ T5956] usb 3-1: Product: syz [ 1531.038053][ T5956] usb 3-1: Manufacturer: syz [ 1531.049785][ T5956] usb 3-1: SerialNumber: syz [ 1531.078306][ T5956] usb 3-1: config 0 descriptor?? [ 1531.167943][T22766] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1531.495624][ T5956] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 1531.502541][ T5956] input input151: Device does not respond to id packet M [ 1531.511305][ T5956] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 1531.517644][ T5956] input input151: Device does not respond to id packet P [ 1531.543744][ T5956] iforce 3-1:0.0: usb_submit_urb failed: -32 [ 1531.550897][ T5956] input input151: Device does not respond to id packet B [ 1531.873284][ T5956] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1531.883796][ T5956] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1531.890415][ T5956] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1531.897651][ T5956] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 1531.939265][ T5956] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input151 [ 1531.985241][ T5956] usb 3-1: USB disconnect, device number 116 [ 1533.159658][T24834] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4598'. [ 1533.171362][T24834] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4598'. [ 1533.180624][T24834] netlink: 'syz.2.4598': attribute type 19 has an invalid length. [ 1533.236074][T24834] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4598'. [ 1533.926846][T24846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1533.945747][T24846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1533.983308][T24846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1534.003720][T24846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1534.028445][T24846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1534.048981][T24846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1535.302425][ T5905] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 1535.527942][ T5905] usb 2-1: Using ep0 maxpacket: 32 [ 1535.542872][ T5905] usb 2-1: config 0 has an invalid interface number: 4 but max is 0 [ 1535.552597][ T5905] usb 2-1: config 0 has no interface number 0 [ 1535.562726][ T5905] usb 2-1: config 0 interface 4 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1535.582965][ T5905] usb 2-1: config 0 interface 4 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1535.623487][ T5905] usb 2-1: config 0 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1535.704160][ T5905] usb 2-1: New USB device found, idVendor=046d, idProduct=c537, bcdDevice= 0.00 [ 1535.713616][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1535.829452][ T5905] usb 2-1: config 0 descriptor?? [ 1535.997903][ T5956] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 1536.118001][ T798] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 1536.158059][ T5956] usb 4-1: Using ep0 maxpacket: 8 [ 1536.168665][ T5956] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 1536.183124][ T5956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1536.197540][ T5956] usb 4-1: Product: syz [ 1536.205882][ T5956] usb 4-1: Manufacturer: syz [ 1536.214281][ T5956] usb 4-1: SerialNumber: syz [ 1536.226153][ T5956] usb 4-1: config 0 descriptor?? [ 1536.252041][ T5905] logitech-djreceiver 0003:046D:C537.002D: hidraw0: USB HID v10.00 Device [HID 046d:c537] on usb-dummy_hcd.1-1/input4 [ 1536.268067][ T798] usb 3-1: Using ep0 maxpacket: 32 [ 1536.289748][ T798] usb 3-1: config 0 has an invalid interface number: 4 but max is 0 [ 1536.298208][ T5956] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 1536.417674][ T798] usb 3-1: config 0 has no interface number 0 [ 1536.424071][ T5956] pctv452e: pctv452e_power_ctrl: 1 [ 1536.424071][ T5956] [ 1536.523247][ T5905] usb 2-1: USB disconnect, device number 112 [ 1536.533452][ T798] usb 3-1: config 0 interface 4 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1536.545168][ T5956] usb 4-1: selecting invalid altsetting 3 [ 1536.555652][ T5956] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 1536.555652][ T5956] [ 1536.579900][ T798] usb 3-1: config 0 interface 4 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1536.600745][T24882] fido_id[24882]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 1536.645175][ T5956] dvb-usb: bulk message failed: -22 (5/0) [ 1536.656467][ T798] usb 3-1: config 0 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1536.699868][ T5956] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1536.731383][ T798] usb 3-1: New USB device found, idVendor=046d, idProduct=c537, bcdDevice= 0.00 [ 1536.741903][ T5956] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 1536.752668][T24876] dtv5100: wlen = 0, aborting. [ 1536.759133][T24876] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4608'. [ 1536.793389][ T798] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1536.805414][ T5956] usb 4-1: media controller created [ 1536.811161][ T5956] dvb-usb: bulk message failed: -22 (8/0) [ 1536.820140][ T798] usb 3-1: config 0 descriptor?? [ 1536.833096][ T5956] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 1536.841946][ T5956] dvb-usb: MAC address reading failed. [ 1536.866973][ T5956] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1537.051146][ T5956] DVB: Unable to find symbol stb0899_attach() [ 1537.087765][ T5956] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 1537.265007][ T798] logitech-djreceiver 0003:046D:C537.002E: hidraw0: USB HID v10.00 Device [HID 046d:c537] on usb-dummy_hcd.2-1/input4 [ 1537.607933][ T5956] rc_core: IR keymap rc-tt-1500 not found [ 1537.704928][ T5956] Registered IR keymap rc-empty [ 1537.711468][ T5956] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 1537.727232][T24901] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4609'. [ 1537.736212][T24901] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4609'. [ 1537.745354][T24901] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4609'. [ 1537.788831][T24901] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4609'. [ 1537.803769][ T5956] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input152 [ 1537.806218][ T5905] usb 3-1: USB disconnect, device number 117 [ 1537.924849][ T5956] dvb-usb: schedule remote query interval to 100 msecs. [ 1538.079162][ T5956] pctv452e: pctv452e_power_ctrl: 0 [ 1538.079162][ T5956] [ 1538.135558][ T5956] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 1538.188208][ T5956] dvb-usb: bulk message failed: -22 (4/0) [ 1538.332794][ T5956] dvb-usb: error -22 while querying for an remote control event. [ 1538.453037][ T5956] dvb-usb: bulk message failed: -22 (4/0) [ 1538.464890][ T5956] dvb-usb: error -22 while querying for an remote control event. [ 1538.557894][ T5905] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 1538.736245][ T5956] dvb-usb: bulk message failed: -22 (4/0) [ 1538.742192][ T5956] dvb-usb: error -22 while querying for an remote control event. [ 1538.887931][ T5956] dvb-usb: bulk message failed: -22 (4/0) [ 1538.893728][ T5956] dvb-usb: error -22 while querying for an remote control event. [ 1538.909687][ T5905] usb 2-1: Using ep0 maxpacket: 8 [ 1538.944586][ T5905] usb 2-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 1538.957679][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1538.967897][ T5905] usb 2-1: Product: syz [ 1538.972284][ T5905] usb 2-1: Manufacturer: syz [ 1538.980428][ T5905] usb 2-1: SerialNumber: syz [ 1538.998816][ T5905] usb 2-1: config 0 descriptor?? [ 1539.008990][ T5905] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 1539.020425][ T5905] pctv452e: pctv452e_power_ctrl: 1 [ 1539.020425][ T5905] [ 1539.028028][ T5956] dvb-usb: bulk message failed: -22 (4/0) [ 1539.033839][ T5956] dvb-usb: error -22 while querying for an remote control event. [ 1539.100023][ T5956] usb 4-1: USB disconnect, device number 7 [ 1539.177950][ T5890] usb 3-1: new full-speed USB device number 118 using dummy_hcd [ 1539.295491][ T5905] usb 2-1: selecting invalid altsetting 3 [ 1539.328694][T24902] dtv5100: wlen = 0, aborting. [ 1539.340334][T24898] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4612'. [ 1539.391435][ T5905] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 1539.391435][ T5905] [ 1539.417490][ T5905] dvb-usb: bulk message failed: -22 (5/0) [ 1539.425066][ T5890] usb 3-1: too many endpoints for config 0 interface 0 altsetting 2: 254, using maximum allowed: 30 [ 1539.441590][ T5905] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1539.451463][ T5890] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1539.497081][ T5905] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 1539.513681][ T5890] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1539.525774][ T5905] usb 2-1: media controller created [ 1539.531549][ T5905] dvb-usb: bulk message failed: -22 (8/0) [ 1539.532213][ T5956] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 1539.537504][ T5890] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1539.567006][ T5905] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 1539.654109][ T5905] dvb-usb: MAC address reading failed. [ 1539.672884][ T5890] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1539.812536][ T5905] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1539.821408][ T5890] usb 3-1: New USB device found, idVendor=1e7d, idProduct=3138, bcdDevice= 0.00 [ 1540.030026][T24924] team0: Device gtp0 is of different type [ 1540.119492][ T5890] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1540.194682][ T5890] usb 3-1: config 0 descriptor?? [ 1540.564929][ T5905] DVB: Unable to find symbol stb0899_attach() [ 1540.571375][ T5905] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 1540.615866][ T5890] usbhid 3-1:0.0: can't add hid device: -71 [ 1540.622301][ T5890] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1540.658441][ T5890] usb 3-1: USB disconnect, device number 118 [ 1540.816937][ T5905] rc_core: IR keymap rc-tt-1500 not found [ 1540.834607][ T5905] Registered IR keymap rc-empty [ 1540.855104][ T5905] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 1540.879261][ T5905] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input153 [ 1541.180037][ T5905] dvb-usb: schedule remote query interval to 100 msecs. [ 1541.187226][ T5905] pctv452e: pctv452e_power_ctrl: 0 [ 1541.187226][ T5905] [ 1541.196876][ T5905] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 1541.212722][ T5905] usb 2-1: USB disconnect, device number 113 [ 1541.298922][ T1217] dvb-usb: bulk message failed: -22 (4/0) [ 1541.304816][ T1217] dvb-usb: error -22 while querying for an remote control event. [ 1541.428022][T24945] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1541.473186][ T5905] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 1542.244614][T24954] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1543.202698][ T5956] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 1543.364459][ T5956] usb 2-1: Using ep0 maxpacket: 16 [ 1543.384821][ T5956] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1543.396622][ T5956] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1543.431273][ T5956] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1543.440634][ T5956] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1543.456014][ T5956] usb 2-1: Product: syz [ 1543.468128][ T5956] usb 2-1: Manufacturer: syz [ 1543.487029][T24962] loop2: detected capacity change from 0 to 7 [ 1543.497841][ T5956] usb 2-1: SerialNumber: syz [ 1543.517101][ T5956] usb 2-1: config 0 descriptor?? [ 1543.613771][ T5956] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1543.647945][ T5956] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1543.683322][T24968] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4627'. [ 1543.698951][T11115] Dev loop2: unable to read RDB block 7 [ 1543.704580][T11115] loop2: unable to read partition table [ 1543.721353][T11115] loop2: partition table beyond EOD, truncated [ 1543.735257][T24963] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4626'. [ 1543.760921][T24962] Dev loop2: unable to read RDB block 7 [ 1543.766535][T24962] loop2: unable to read partition table [ 1543.788077][T24962] loop2: partition table beyond EOD, truncated [ 1543.819258][T24963] IPv6: NLM_F_REPLACE set, but no existing node found! [ 1543.826646][T24962] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑච) failed (rc=-5) [ 1543.871726][ T5194] Dev loop2: unable to read RDB block 7 [ 1543.877419][ T5194] loop2: unable to read partition table [ 1543.897911][ T5194] loop2: partition table beyond EOD, truncated [ 1543.979132][T24976] binder: 24970:24976 ioctl 4018620d 0 returned -22 [ 1544.078395][ T5930] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 1544.099084][ T5956] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1544.106310][ T5956] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 1544.113961][ T5956] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 1544.121483][ T5956] em28xx 2-1:0.0: No AC97 audio processor [ 1544.136691][ T5956] usb 2-1: USB disconnect, device number 114 [ 1544.272789][ T5930] usb 4-1: device descriptor read/64, error -71 [ 1544.299977][ T5956] em28xx 2-1:0.0: Disconnecting em28xx [ 1544.312203][ T5956] em28xx 2-1:0.0: Freeing device [ 1544.555819][ T5930] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 1545.200294][ T5930] usb 4-1: device descriptor read/64, error -71 [ 1545.328599][ T5930] usb usb4-port1: attempt power cycle [ 1545.725040][ T5930] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 1545.800557][T25000] syzkaller0: entered promiscuous mode [ 1545.808181][T25000] syzkaller0: entered allmulticast mode [ 1545.853624][ T5930] usb 4-1: device descriptor read/8, error -71 [ 1545.917219][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.924849][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1545.956167][ T5194] Dev loop2: unable to read RDB block 7 [ 1545.964676][ T5194] loop2: unable to read partition table [ 1545.970849][ T5194] loop2: partition table beyond EOD, truncated [ 1546.144372][ T5930] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1546.189749][ T5930] usb 4-1: device descriptor read/8, error -71 [ 1546.368111][ T5930] usb usb4-port1: unable to enumerate USB device [ 1546.770805][T22766] wlan0: Trigger new scan to find an IBSS to join [ 1547.508216][T25025] binder: BINDER_SET_CONTEXT_MGR already set [ 1547.514414][T25025] binder: 25018:25025 ioctl 4018620d 200000000040 returned -16 [ 1549.848704][T25050] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4644'. [ 1549.858821][T25050] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4644'. [ 1549.870441][T25050] netlink: 'syz.4.4644': attribute type 19 has an invalid length. [ 1549.891791][T25050] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4644'. [ 1550.549697][T25061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4647'. [ 1550.558801][T25061] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4647'. [ 1550.567671][T25061] netlink: 'syz.2.4647': attribute type 19 has an invalid length. [ 1550.575809][T25061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4647'. [ 1550.758005][T22766] wlan0: Trigger new scan to find an IBSS to join [ 1551.453606][ T29] kauditd_printk_skb: 28 callbacks suppressed [ 1551.453623][ T29] audit: type=1326 audit(1772952444.127:12406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1551.769397][ T29] audit: type=1326 audit(1772952444.127:12407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1551.815115][ T58] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1551.879475][ T29] audit: type=1326 audit(1772952444.127:12408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1552.022383][ T29] audit: type=1326 audit(1772952444.127:12409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1552.086240][ T29] audit: type=1326 audit(1772952444.127:12410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1552.155254][T25082] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4652'. [ 1552.164510][T25082] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4652'. [ 1552.268523][ T29] audit: type=1326 audit(1772952444.127:12411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1552.317934][T25082] netlink: 'syz.4.4652': attribute type 19 has an invalid length. [ 1552.327522][ T29] audit: type=1326 audit(1772952444.127:12412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1552.373362][ T29] audit: type=1326 audit(1772952444.287:12413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1552.397229][T25082] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4652'. [ 1552.413204][ T29] audit: type=1326 audit(1772952444.287:12414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1552.547863][ T29] audit: type=1326 audit(1772952444.287:12415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25065 comm="syz.1.4648" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f583159c799 code=0x7ffc0000 [ 1553.687954][ T5930] usb 4-1: new full-speed USB device number 12 using dummy_hcd [ 1553.921278][ T5930] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1553.940494][ T5930] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1553.950010][ T5930] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1553.958579][ T5930] usb 4-1: Product: syz [ 1553.962751][ T5930] usb 4-1: Manufacturer: syz [ 1553.967348][ T5930] usb 4-1: SerialNumber: syz [ 1554.151623][ T5930] usb 4-1: config 0 descriptor?? [ 1554.168362][ T5930] usb 4-1: bad CDC descriptors [ 1554.249488][ T5930] usb 4-1: unsupported MDLM descriptors [ 1554.939741][T25101] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1555.278175][ T5890] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 1555.403188][T25123] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1555.414069][T25123] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1555.469292][ T5890] usb 2-1: Using ep0 maxpacket: 8 [ 1555.476665][ T5890] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1555.490040][ T5890] usb 2-1: config 0 has no interfaces? [ 1555.501041][ T5890] usb 2-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 1555.510810][ T5890] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1555.528345][ T5890] usb 2-1: Product: syz [ 1555.554376][ T5890] usb 2-1: Manufacturer: syz [ 1555.565504][ T5890] usb 2-1: SerialNumber: syz [ 1555.581772][ T5890] usb 2-1: config 0 descriptor?? [ 1555.864451][T25119] dtv5100: wlen = 0, aborting. [ 1555.873806][T25119] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4659'. [ 1556.290348][T25138] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1556.806914][ T5930] usb 4-1: USB disconnect, device number 12 [ 1557.370716][ T5930] usb 2-1: USB disconnect, device number 115 [ 1558.251361][T25161] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4670'. [ 1558.260729][T25161] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4670'. [ 1558.270554][T25161] netlink: 'syz.4.4670': attribute type 19 has an invalid length. [ 1558.280607][T25161] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4670'. [ 1558.926969][T25174] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1559.959163][ T130] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1560.059558][ T5930] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 1560.154413][T25183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1560.175448][T25183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1560.200457][T25183] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4679'. [ 1560.217930][ T5930] usb 2-1: Using ep0 maxpacket: 32 [ 1560.229805][ T5930] usb 2-1: config 0 has an invalid interface number: 4 but max is 0 [ 1560.238394][ T5930] usb 2-1: config 0 has no interface number 0 [ 1560.251437][T25183] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1560.259071][ T5930] usb 2-1: config 0 interface 4 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1560.269618][T25183] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1560.278124][ T5930] usb 2-1: config 0 interface 4 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1560.288341][ T5956] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1560.299942][ T5930] usb 2-1: config 0 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1560.313774][ T5930] usb 2-1: New USB device found, idVendor=046d, idProduct=c537, bcdDevice= 0.00 [ 1560.323843][ T5930] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1560.339050][ T5930] usb 2-1: config 0 descriptor?? [ 1560.438656][ T5956] usb 4-1: Using ep0 maxpacket: 16 [ 1560.495103][ T5956] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1560.513395][ T5956] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1560.555042][T25190] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1560.616139][ T5956] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1560.628682][ T5956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1560.646079][ T5956] usb 4-1: Product: syz [ 1560.656339][ T5956] usb 4-1: Manufacturer: syz [ 1560.661594][ T5956] usb 4-1: SerialNumber: syz [ 1560.724449][ T5956] usb 4-1: config 0 descriptor?? [ 1560.736514][ T5956] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1560.751336][ T5956] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 1560.759363][T22766] wlan0: Trigger new scan to find an IBSS to join [ 1560.765259][ T5930] logitech-djreceiver 0003:046D:C537.002F: hidraw0: USB HID v10.00 Device [HID 046d:c537] on usb-dummy_hcd.1-1/input4 [ 1560.965153][ T5930] usb 2-1: USB disconnect, device number 116 [ 1561.208287][T25204] binder: 25203:25204 ioctl 4018620d 0 returned -22 [ 1561.420202][ T5956] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1561.444204][ T5956] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 1561.555041][ T5956] em28xx 4-1:0.0: AC97 chip type couldn't be determined [ 1561.582784][ T5956] em28xx 4-1:0.0: No AC97 audio processor [ 1561.628500][ T5956] usb 4-1: USB disconnect, device number 13 [ 1561.653682][ T5956] em28xx 4-1:0.0: Disconnecting em28xx [ 1561.678721][ T5956] em28xx 4-1:0.0: Freeing device [ 1561.794040][T25221] binder: BINDER_SET_CONTEXT_MGR already set [ 1561.800226][T25221] binder: 25215:25221 ioctl 4018620d 200000000040 returned -16 [ 1561.810585][T25221] binder: 25215:25221 ioctl c0306201 0 returned -14 [ 1562.715404][T25229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4688'. [ 1562.728015][T25229] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4688'. [ 1562.736980][T25229] netlink: 'syz.3.4688': attribute type 19 has an invalid length. [ 1562.746071][T25229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4688'. [ 1563.160842][ T58] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1563.238424][T25244] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4690'. [ 1563.575889][T25250] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1563.744970][T25250] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1565.428036][ T5956] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 1565.613991][ T5956] usb 2-1: Using ep0 maxpacket: 32 [ 1565.621849][ T5956] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 52, changing to 9 [ 1565.635763][ T5956] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 8241, setting to 1024 [ 1565.676805][ T5956] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 1565.696452][ T5956] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1565.706415][ T5956] usb 2-1: Product: syz [ 1565.710905][ T5956] usb 2-1: Manufacturer: syz [ 1565.723126][ T5956] usb 2-1: SerialNumber: syz [ 1565.736536][ T5956] usb 2-1: config 0 descriptor?? [ 1565.756301][ T1340] wlan0: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID [ 1565.814859][ T5956] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1565.927967][ T5930] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1565.963868][T25260] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4698'. [ 1566.044949][T25281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1566.077623][T25281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1566.088143][ T5930] usb 4-1: Using ep0 maxpacket: 16 [ 1566.096887][ T5930] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1566.106841][ T5930] usb 4-1: config 13 has an invalid interface number: 50 but max is 0 [ 1566.115433][ T5930] usb 4-1: config 13 has no interface number 0 [ 1566.122826][ T5930] usb 4-1: config 13 interface 50 altsetting 167 bulk endpoint 0x88 has invalid maxpacket 16 [ 1566.126985][T25283] syzkaller1: entered promiscuous mode [ 1566.133758][ T5930] usb 4-1: config 13 interface 50 has no altsetting 0 [ 1566.147892][T25283] syzkaller1: entered allmulticast mode [ 1566.160378][ T5930] usb 4-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 1566.488578][ T5930] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1566.496798][ T5930] usb 4-1: Product: syz [ 1566.501107][ T5930] usb 4-1: Manufacturer: syz [ 1566.505727][ T5930] usb 4-1: SerialNumber: syz [ 1566.530215][T25271] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1566.804849][ T130] usb 2-1: Failed to submit usb control message: -71 [ 1566.817046][ T130] usb 2-1: unable to send the bmi data to the device: -71 [ 1566.825147][ T5956] usb 2-1: USB disconnect, device number 117 [ 1566.833370][ T130] usb 2-1: unable to get target info from device [ 1566.869866][ T130] usb 2-1: could not get target info (-71) [ 1566.912794][ T130] usb 2-1: could not probe fw (-71) [ 1567.064998][ T5930] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1567.082974][ T5930] usb 4-1: MIDIStreaming interface descriptor not found [ 1567.231784][ T5930] usb 4-1: USB disconnect, device number 14 [ 1567.234871][T25293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1567.268486][T25293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1567.310003][T25293] ------------[ cut here ]------------ [ 1567.315507][T25293] usb 5-1: BOGUS control dir, pipe 80004b80 doesn't match bRequestType c0 [ 1567.324208][T25293] WARNING: drivers/usb/core/urb.c:413 at usb_submit_urb+0x1052/0x18b0, CPU#1: syz.4.4707/25293 [ 1567.334771][T25293] Modules linked in: [ 1567.339139][T25293] CPU: 1 UID: 0 PID: 25293 Comm: syz.4.4707 Tainted: G L syzkaller #0 PREEMPT(full) [ 1567.350203][T25293] Tainted: [L]=SOFTLOCKUP [ 1567.354562][T25293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1567.364688][T25293] RIP: 0010:usb_submit_urb+0x1114/0x18b0 [ 1567.370442][T25293] Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c2 f2 ff ff 89 e9 [ 1567.390248][T25293] RSP: 0018:ffffc9001cd0f688 EFLAGS: 00010246 [ 1567.396319][T25293] RAX: 0000000000000000 RBX: ffff888027e5a900 RCX: 0000000080004b80 [ 1567.404359][T25293] RDX: ffff88804c16e840 RSI: ffffffff8c7f03a0 RDI: ffffffff901ec340 [ 1567.412378][T25293] RBP: 1ffff1100667a9a8 R08: 00000000000000c0 R09: 0000000000000000 [ 1567.420442][T25293] R10: ffffc9001cd0f780 R11: fffff520039a1efc R12: ffff88804c96c100 [ 1567.428482][T25293] R13: ffff8880333d4d40 R14: 0000000080004b80 R15: ffff88804c16e840 [ 1567.436519][T25293] FS: 00007f9d7b9026c0(0000) GS:ffff888125563000(0000) knlGS:0000000000000000 [ 1567.445503][T25293] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1567.452165][T25293] CR2: 0000001b30b23ffc CR3: 0000000056aec000 CR4: 00000000003526f0 [ 1567.460186][T25293] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1567.468335][T25293] DR3: 000000000000000c DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1567.476316][T25293] Call Trace: [ 1567.479624][T25293] [ 1567.482553][T25293] ? __init_swait_queue_head+0xa9/0x150 [ 1567.488152][T25293] usb_start_wait_urb+0x12b/0x510 [ 1567.493212][T25293] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1567.498793][T25293] usb_control_msg+0x232/0x3e0 [ 1567.503584][T25293] dtv5100_i2c_msg+0x231/0x2f0 [ 1567.508540][T25293] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 1567.513389][T25293] ? __se_sys_ioctl+0x47/0x170 [ 1567.518255][T25293] __i2c_transfer+0x79a/0x2020 [ 1567.523125][T25293] __i2c_smbus_xfer+0xfca/0x1f70 [ 1567.528116][T25293] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 1567.533490][T25293] ? lockdep_hardirqs_on+0x7a/0x110 [ 1567.538767][T25293] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1567.544659][T25293] ? rt_mutex_lock_nested+0x15c/0x1e0 [ 1567.550147][T25293] i2c_smbus_xfer+0x1f4/0x310 [ 1567.554848][T25293] i2cdev_ioctl_smbus+0x434/0x730 [ 1567.559956][T25293] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 1567.565548][T25293] i2cdev_ioctl+0x615/0x880 [ 1567.570167][T25293] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1567.575229][T25293] ? __fget_files+0x2a/0x420 [ 1567.579856][T25293] ? __fget_files+0x3a0/0x420 [ 1567.584555][T25293] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1567.589543][T25293] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1567.594560][T25293] __se_sys_ioctl+0xfc/0x170 [ 1567.599199][T25293] do_syscall_64+0x14d/0xf80 [ 1567.603823][T25293] ? trace_irq_disable+0x3b/0x150 [ 1567.608898][T25293] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1567.614967][T25293] ? clear_bhb_loop+0x40/0x90 [ 1567.619665][T25293] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1567.625543][T25293] RIP: 0033:0x7f9d7a99c799 [ 1567.629982][T25293] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1567.649836][T25293] RSP: 002b:00007f9d7b902028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1567.658328][T25293] RAX: ffffffffffffffda RBX: 00007f9d7ac15fa0 RCX: 00007f9d7a99c799 [ 1567.666287][T25293] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000004 [ 1567.674292][T25293] RBP: 00007f9d7aa32bd9 R08: 0000000000000000 R09: 0000000000000000 [ 1567.682293][T25293] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1567.690326][T25293] R13: 00007f9d7ac16038 R14: 00007f9d7ac15fa0 R15: 00007f9d7ad3fa48 [ 1567.698329][T25293] [ 1567.701385][T25293] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1567.708684][T25293] CPU: 1 UID: 0 PID: 25293 Comm: syz.4.4707 Tainted: G L syzkaller #0 PREEMPT(full) [ 1567.719606][T25293] Tainted: [L]=SOFTLOCKUP [ 1567.723913][T25293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1567.733951][T25293] Call Trace: [ 1567.737256][T25293] [ 1567.740173][T25293] vpanic+0x56c/0xa60 [ 1567.744181][T25293] ? __pfx__printk+0x10/0x10 [ 1567.748752][T25293] ? __pfx_vpanic+0x10/0x10 [ 1567.753241][T25293] ? is_bpf_text_address+0x292/0x2b0 [ 1567.758511][T25293] ? is_bpf_text_address+0x26/0x2b0 [ 1567.763692][T25293] panic+0xc5/0xd0 [ 1567.767399][T25293] ? __pfx_panic+0x10/0x10 [ 1567.771801][T25293] __warn+0x315/0x4f0 [ 1567.775799][T25293] ? usb_submit_urb+0x1052/0x18b0 [ 1567.780813][T25293] ? usb_submit_urb+0x1052/0x18b0 [ 1567.785821][T25293] __report_bug+0x29a/0x540 [ 1567.790409][T25293] ? usb_submit_urb+0x1052/0x18b0 [ 1567.795418][T25293] ? __pfx___report_bug+0x10/0x10 [ 1567.800434][T25293] ? lockdep_hardirqs_on+0x7a/0x110 [ 1567.805620][T25293] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1567.811440][T25293] report_bug_entry+0x19a/0x290 [ 1567.816281][T25293] ? usb_submit_urb+0x1114/0x18b0 [ 1567.821291][T25293] ? usb_submit_urb+0x1119/0x18b0 [ 1567.826299][T25293] handle_bug+0xce/0x200 [ 1567.830525][T25293] exc_invalid_op+0x1a/0x50 [ 1567.835010][T25293] asm_exc_invalid_op+0x1a/0x20 [ 1567.839842][T25293] RIP: 0010:usb_submit_urb+0x1114/0x18b0 [ 1567.845478][T25293] Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c2 f2 ff ff 89 e9 [ 1567.865064][T25293] RSP: 0018:ffffc9001cd0f688 EFLAGS: 00010246 [ 1567.871115][T25293] RAX: 0000000000000000 RBX: ffff888027e5a900 RCX: 0000000080004b80 [ 1567.879064][T25293] RDX: ffff88804c16e840 RSI: ffffffff8c7f03a0 RDI: ffffffff901ec340 [ 1567.887014][T25293] RBP: 1ffff1100667a9a8 R08: 00000000000000c0 R09: 0000000000000000 [ 1567.894965][T25293] R10: ffffc9001cd0f780 R11: fffff520039a1efc R12: ffff88804c96c100 [ 1567.902915][T25293] R13: ffff8880333d4d40 R14: 0000000080004b80 R15: ffff88804c16e840 [ 1567.910887][T25293] ? usb_submit_urb+0x10a3/0x18b0 [ 1567.915903][T25293] ? __init_swait_queue_head+0xa9/0x150 [ 1567.921430][T25293] usb_start_wait_urb+0x12b/0x510 [ 1567.926444][T25293] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1567.932005][T25293] usb_control_msg+0x232/0x3e0 [ 1567.936763][T25293] dtv5100_i2c_msg+0x231/0x2f0 [ 1567.941519][T25293] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 1567.946353][T25293] ? __se_sys_ioctl+0x47/0x170 [ 1567.951103][T25293] __i2c_transfer+0x79a/0x2020 [ 1567.955881][T25293] __i2c_smbus_xfer+0xfca/0x1f70 [ 1567.960812][T25293] ? __pfx___i2c_smbus_xfer+0x10/0x10 [ 1567.966176][T25293] ? lockdep_hardirqs_on+0x7a/0x110 [ 1567.971370][T25293] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1567.977160][T25293] ? rt_mutex_lock_nested+0x15c/0x1e0 [ 1567.982528][T25293] i2c_smbus_xfer+0x1f4/0x310 [ 1567.987244][T25293] i2cdev_ioctl_smbus+0x434/0x730 [ 1567.992329][T25293] ? __pfx_i2cdev_ioctl_smbus+0x10/0x10 [ 1567.997879][T25293] i2cdev_ioctl+0x615/0x880 [ 1568.002457][T25293] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1568.007467][T25293] ? __fget_files+0x2a/0x420 [ 1568.012048][T25293] ? __fget_files+0x3a0/0x420 [ 1568.016720][T25293] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1568.021755][T25293] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1568.026773][T25293] __se_sys_ioctl+0xfc/0x170 [ 1568.031384][T25293] do_syscall_64+0x14d/0xf80 [ 1568.035966][T25293] ? trace_irq_disable+0x3b/0x150 [ 1568.040989][T25293] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1568.047077][T25293] ? clear_bhb_loop+0x40/0x90 [ 1568.051782][T25293] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1568.057693][T25293] RIP: 0033:0x7f9d7a99c799 [ 1568.062134][T25293] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1568.081923][T25293] RSP: 002b:00007f9d7b902028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1568.090508][T25293] RAX: ffffffffffffffda RBX: 00007f9d7ac15fa0 RCX: 00007f9d7a99c799 [ 1568.098469][T25293] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000004 [ 1568.106447][T25293] RBP: 00007f9d7aa32bd9 R08: 0000000000000000 R09: 0000000000000000 [ 1568.114412][T25293] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1568.122370][T25293] R13: 00007f9d7ac16038 R14: 00007f9d7ac15fa0 R15: 00007f9d7ad3fa48 [ 1568.130334][T25293] [ 1568.133628][T25293] Kernel Offset: disabled [ 1568.137944][T25293] Rebooting in 86400 seconds..