last executing test programs: 12.855221424s ago: executing program 3 (id=3848): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x8e, 0x88, 0x5, 0x20, 0x8086, 0x9500, 0xb6d8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x1, 0x0, 0x0, 0x15, 0xcc, 0x1c}}]}}]}}, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) mknodat$null(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x103) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)={0x28, 0x0, 0x101, 0x0, 0x3, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random='n'}]}, 0x28}}, 0x4800) read$FUSE(0xffffffffffffffff, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r3 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) fcntl$lock(r3, 0x25, &(0x7f00000001c0)={0x1, 0x2, 0x20000000000, 0x77d, r2}) sched_setattr(r2, &(0x7f0000000240)={0x38, 0x3, 0x1000006c, 0x0, 0x10, 0xffffffff, 0xfffffffffffffff9, 0x1, 0x0, 0x6}, 0x0) syz_open_procfs(r2, &(0x7f0000000200)='children\x00') syz_usb_connect(0x0, 0x62, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d2406010103020001000600060924030505030605810924030601030405050724040501"], 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r1, &(0x7f0000002380)={0x2020, 0x0, 0x0}, 0x2020) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet(r5, &(0x7f0000002f80)=[{{&(0x7f0000000300)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000e40)=[@ip_ttl={{0x10, 0x0, 0x2, 0x7}}, @ip_tos_int={{0x10, 0x1000000, 0x1, 0x1ff}}], 0x20}}], 0x1, 0x20000044) write$FUSE_INIT(r1, &(0x7f00000004c0)={0x50, 0x0, r4, {0x7, 0x9, 0x0, 0x18292, 0x1, 0x0, 0x0, 0xffffffff}}, 0x50) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002cbd701004000000060000000600010005000000080009000200000008000b"], 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) sendmsg$L2TP_CMD_SESSION_CREATE(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, r6, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000090}, 0x4080) read$FUSE(r1, &(0x7f0000006580)={0x2020}, 0xffffffffffffff8d) truncate(&(0x7f0000000080)='./file0\x00', 0x8cff) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000a40)={&(0x7f00000000c0)=[{0x81e, 0x16800, 0x0, 0x0}, {0x6, 0x4001, 0x0, 0x0}], 0x2}) 9.574858088s ago: executing program 0 (id=3858): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockname$inet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x122) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000400)=@v3={0x3000000, [{0x9, 0x1}, {0x0, 0x3d9b}]}, 0x18, 0x1) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], &(0x7f00000002c0)=""/203, 0xfffffffffffffe5f) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) fsopen(&(0x7f0000000040)='afs\x00', 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x5) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x8010, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffdd5}, 0x94) sched_getattr(0x0, &(0x7f0000000180)={0x38}, 0x38, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1}, 0xc) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, {0xa, 0x0, 0x0, @mcast1, 0xfffffffd}, 0x0, {[0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0x0, 0x800]}}, 0x5c) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, 0x0, 0x0) 8.857143929s ago: executing program 3 (id=3860): openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs(0x0, 0x0) epoll_create1(0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) r0 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xe, &(0x7f0000000a40)=ANY=[@ANYBLOB="b70200000d000000bfa300000000000005000000000000007a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400010000050404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf27fb6d2c643db7e2d5fb4b0936cdf827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923dd29c034055b67d5b310efcfa89147a7fb0a93d035f2f206d2ef831ab7ea0c34f17e3ad6eecbb622003b538dfd8e012e79578e51bc53099e90f4580d7be3e8c254a5cba117cbdb9cd38bdb2cc8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e6a9f65f1328d6704902cbe7bc04b82d2789cb132b8667c214733a18c8b6619f28d996d60a17e3c184b751c51160100000000000080148b9a31ee8dc8b544f3c4a532e60a0ac346dfebd31a08060000000200000000000000334d83239dd20100008000000000d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08a406f99f7b1e1ad828267d4eadd3964663e085354133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0183babc190ae2ebf8aad34732181feb28cb0bae7c34dc5e7c805210600000000000000c3dec04b25df45d4f71ab158c36657b7218baa07a99bd50499ccc421ace5e845885efb5b9964e4beba3da8223fe5308e4e65ee93e107000000f8ddebf70132a4d01776839b8eccf707882042e716df9b57b290c661d4e85031086197bcc5cb0e221a0c34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb0015982730711c599e1c72ffa11ed8be1a6830d7507005154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d1cdac944779dc08a705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe3304000000323e9c707fe81436b024c2574980397bc49d70c060d57bc88fbe3bbaa058b040362ab926150763fb099408885afc2bf9a46a076b7babfcddeff8c35030669ea69f5e4be1b8e0d6697e97186f9ae97d5670dba6623279f73db9dec75070cd9ab0fda6b069ef6d2857ca3e4e6068f1bf710d133d541da86e046e513b3177e4a6cc999dc21c3ef408e6b178e7c9f274d7fafc8d757d33dfa35aa2b2ff7f9a7d365e63845f3e1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cadecc13219ba7518aa4f7db34ead13484742067ab743c1d82a5687f2ed690000010000000000000000000000000000000000000099d4fa0000000000003f0ecdc7c82e72919c91d2039afe17e95edef8ba72205beff7771bcb293747b88486cacee403000000a2919a4b09e168e4e4d5ff2ed893f2e314679fa69fc7e0cf761f91b18725704a01c56009a9f748e5aaf30a10bd8c409b1870c1f75e26b45264e3d3f8e0048e55ae289c2f884d0766cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c1540bf3d162dc1c27fa30f0dc60b9f257db5d1c7ed2efce676a93110904d5e055af44664b53c764d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354da8de21eada75d3a3afb2c76ff0700007976694b6a0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d201721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e671282a2d3066ac968c7d7d7db195f255b1b4a85eb9ee0a3b68c9e209756623adf685dd715d68ed1274b4d5502f512493af8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb20407ff7098b7174bef66fa03a99b5c0c20b378065fac4ef9ac2d0d804b9400000060e5d3f1749f6aecf69ba83a71caa9bdddc679f1b826f74b6563a4be1fd82b73c8c2bc"], 0x0}, 0x90) r4 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r4, &(0x7f0000000040)={&(0x7f0000000000)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@rthdr_2292={{0x24, 0x29, 0x39, {0x0, 0x2, 0x2, 0x1, 0x0, [@private1]}}}, @hoplimit={{0x10, 0x29, 0x34, 0x400083e0}}], 0x34}, 0x40808) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r3, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0}}) io_uring_enter(r0, 0x27e2, 0x0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x14, 0x5, 0x1, 0x5}, 0x14}}, 0x2400c000) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) io_uring_register$IORING_REGISTER_RING_FDS(0xffffffffffffffff, 0x13, &(0x7f0000001bc0), 0x2) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, 0x0, 0x184) syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd010203010902"], 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r5, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) recvmmsg(r5, &(0x7f0000006ec0)=[{{0x0, 0x0, 0x0}, 0x25}], 0x1, 0xa00, 0x0) 8.428691256s ago: executing program 0 (id=3863): r0 = syz_open_dev$vim2m(0x0, 0x6, 0x2) r1 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x18) r3 = accept4(0xffffffffffffffff, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000000080)=0xfffffffffffffefc, 0x40000) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x10031, 0xffffffffffffffff, 0x65be1000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f000000d4c0)=[{{&(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000380)=[{&(0x7f00000002c0)="9a2390e6966bd356a21907a555b4a717c85c9481461383f9d8b763b75c900d0c0dc8af39ce8411073e02da46e9d827e03638d97cbbb1b24375064d1ec8edd407e525ef363fd3208b7a7af379abf268dbcd2eb8179dc6e978bfa9db8679c6b98e18d9bddb66f54b40499f4823f60f5888ca2e17f47746d983521f9247c32570bd2b9b425967a7ceb0ff3ec368b88b9ebfd175202eeef3ce125b84ff9938420dee9a4c66e846dd6a12bc21186f", 0xac}, {&(0x7f0000000880)="f46e5249cededc314a30765760b38df0526a4187951134caf300a3316b10b40f1497e261d0e72a0eb6915e1c81cd03d55f6910fffa89c2ab500997bf1b9232f98dbd770fda5bac691fb9e6260fa55591867ce4a6956e747ea3d362e70e202d5689b9612739ea69b2d4e712316dbc485f21d4cede84c84cecbe74faa922afd3fd5c8be53ff513b2d9a82cb1ee17c53145b9467d366ce93dc6f582015f37d28aa007271e7b1578db2badc64284a5e7b0d495e7304d3539d4733063f0af3fd9977722822bab067bd10b37f0f6", 0xcb}], 0x2, &(0x7f0000000d40)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r2, r6, r4]}}, @rights={{0x34, 0x1, 0x1, [r0, r4, r3, r5, r6, 0xffffffffffffffff, r4, r5, r1, r1]}}, @cred={{0x18, 0x1, 0x2, {0xffffffffffffffff}}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, r3, 0xffffffffffffffff, r0, 0xffffffffffffffff, r5, r5]}}, @cred={{0x18, 0x1, 0x2, {0xffffffffffffffff}}}, @cred={{0x18}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, r6]}}], 0xd8, 0x88}}, {{&(0x7f0000000e40)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000fc0), 0x0, &(0x7f00000010c0)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, r4, r6, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, r5]}}, @cred={{0x18}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r4, r4, 0xffffffffffffffff]}}], 0x78, 0x1}}, {{&(0x7f0000001140)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001340)=[{&(0x7f00000011c0)="c8b7f216b37970b670b5cf9b03f4e39133e4db14c29f613be01a03", 0x1b}, {&(0x7f0000001200)="84788cea959e858c9f2c8068dbae4289de560bca9250318c290f0bb6eb14d6f093c12f502d924a66228153f81bae3075a6421ab1e6f2c89353e43139016362e463fc89a45fb2a2e0c50cf1", 0x4b}, {&(0x7f0000001280)="17d1c98a4ed619053cdd157a6105e8a139df11a1b14e6b97facc246b15d7a725006e6e77b7a4fe1cd6f6df744141403687aa1bd81c7885284f1f5d72ac8a0163d0743f39b780a6e5cf7ffc01d9c478eb978b2d311261b89f3b09020a7a5ff827c6a678e80e4997136fba0bac03cc6b9956e5da08ba9f04811160f38f3c4835607c2b47363511765278a02d271c4daf3265fc2b841da07a9e4a", 0x99}], 0x3, &(0x7f0000001380)=[@cred={{0x18}}, @rights={{0x10, 0x1, 0x1, [0xffffffffffffffff]}}], 0x28, 0x4}}, {{0x0, 0x0, &(0x7f0000001580)=[{&(0x7f00000013c0)="a274644b1950c1187445971b958e645fd15416dcd49c87d6cabedd605dcc932ea0e84b58017a53d6f5aeacb936782bf7bd839d7256aaf877ebf45f0e5e48d72673b1669153a1f1477f49a0f356bb21fbe49382eefbf390f838790373372cd07ecb9c1c5b60cc95142707c6d9439c4ee085f3f341ad46bd91315582bca0570517ee910c", 0x83}, {&(0x7f0000001480)="43292eef4a31721e6a063aa946d879b5467d5f88a6e46698b92c9272eaecd12d5fb091f5180a9fb4fb047b036c034c15ae6b6ec922cb938004dde76a3abe823390e47ee9afbea0e81a852e7d518b994494d6a22238b78f314c482322c622bd8c6744047a849d476c75ea4c13cdd6012c84dc503f9a4978e9b8516a1f0612cd2174a78bd01c2385b2630f6634a748272d12617ab025b21fe2ceafe34ae1017272221375f63f453c0c0f1c0df7f416eb52abe00004b963a44b4e1c8b7eb3ed9fe8f55e9a6c4858290c784ccdb5cc1777466a849a647bd9f5b91d065fe01c274dad9670be44", 0xe4}], 0x2, &(0x7f0000001900)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @cred={{0x18}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x64, 0x40}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000001980)="5919ee5b76bcf0c3d583612e9ba5c84b8dffe38a93aeec6dc93cfe20d65a9f44eedd93b18f98faeca5bc2c7e15abcaa23ceccb26edf79b522a8e3a83a896874693a58aa7a401c1b1ee9a3de0de456c5cb64835ca8928893828ca23e6736d1379d06bd07a25edc214", 0x68}, {&(0x7f0000001a00)="0ef035e3dac9d2353b620aa36999bfd13b3a5d5f9b944078aaa510b1a6d598b57d7015c419a71c41e97b462905f9c096fd8a363686497d4d7583d37d83ff0ce5b1336fe22200928ff399d6dba3297214e8c71ace615b8fab15da91f58e83a82350ee9b633d0be503d1c9cf0a046f21f7083fb7da9ce0920e465967e86f4445ac7fbd", 0x82}], 0x2, &(0x7f0000001bc0)=ANY=[@ANYBLOB="100000000100000001000000", @ANYRES32=r5, @ANYBLOB="180000000140000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="100000000100000001000000", @ANYRES32], 0x38, 0x20044014}}, {{&(0x7f0000001c00)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000001e00)=[{&(0x7f0000001c80)="4a99a9323e589b831344ea24d3c7746cc5cf0942a9618b71636e53ab3c7286b3a1fb8f83d5880d13e7d9e002d86c29cc66b8c1d2d0aff98a518f6ad4b87a5df4b5339c69abe85f6c1e2c7146756240d44344089f5befe34ecb2110e3797255ae6f8853eb83755c2aa2691a097793239f1105536e51a8df76c7", 0x79}, {&(0x7f0000001d00)="2b5650cd5f89c8bd277ad4cad193b475228cea0e9e6cb08fb3ddfdabb26afb94a951bd64fba33bd3e50caa85b57f0c5674a312ea9d4c89978d359dc1c26a039a58cb809d061fc93ce4654f6c222c06e6f10e5fba262619673649eb82d86da7429c795b1e0feae55952f47b27b48f24f2a98df32814a8cc3c84e32339a1e9662c40bccb20ee831ed5e3afec90195440c382824aca43ecd596fd6545921f666f785f57700af30b62aecd51068d32155dede81c51cc20feb1d7b8a012359c2002aa25bedf97e0e0892da34bd5e74d6508e857c66a93d890fd6f9fe64a6a0f87c53018b09c9d34de", 0xe6}], 0x2, 0x0, 0x0, 0x8000}}, {{&(0x7f0000001e40)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000006240)=[{&(0x7f0000001ec0)="54a762da9f751d59d5984ed1bbc62bb3f44bb894cbdc89c0b0828a5a4c1a14aaa575bc268a0a5304ddffc83f3bc9b88ea040eea3b8fa3f59c739af20d7b6d67a8fb9ef2d4e7ce2cac4392c1ba5d48e04a931ae4946d7880eb11bbde4f956c64993024e7b75d1348b6139416e5d85b266abebe9421c2d693fbc0321ee578b31f35617750deb01fcd50ae90276485f62ced4e0020f694296051fd916283df61469c9fc", 0xa2}, {&(0x7f0000001f80)="1a49b89e1a075e507f574a0102231ea1fd56f296336ffcb33815", 0x1a}, {&(0x7f0000001fc0)}, {&(0x7f0000000980)="6b67ae0b5d9f0a6743558ed38c629d9eeb0d1fc7d82f878a9b6a3d8254bb0c1d763fb42c82c23bc73b6a5eaef9ab99f88c1c626d3d2182a9a477f862531c331b1faa84660218aebdd17ba0a06290bc6693c7b0d24db026643aebca56e721c13364f891b7e1cd0f5154d6f539e54a57f8870537a92026dfc35aa2ad1ba1ec60ed013cd86afe69e44e2321b6e0d60e7f07460e9e64594ee382505952d87b4921e5f06e2ad4", 0xa4}, {&(0x7f000000d3c0)="3b80d97c34a93b47c9428412976b1f81b5517c425e20700e29d13ff44cec3543ab8632d617bb3189cbdf9748e59f242e1e1783b0b12467160da8afe11a24339633e178e3aac267c1721cf4cf18a77ec4854a56bd3117da9f97a5e89879d8e45fcd2197dc477871075fdfd3f812c8f44b5a3164d0a77f9294d99164e3", 0x7c}, {&(0x7f0000006200)="6ed0eceed4b031aa0ebf4005506ceb", 0xf}], 0x6, &(0x7f0000000a40)=ANY=[@ANYBLOB="100000000100000001000000", @ANYRES32, @ANYBLOB="18000000010000000200224108fc9944762de92c92a95b1c7ddcd04627fb942450aad5841ff25ca2bc746a12da75dc097edf1f4316838d2161536ac982cc2b1f63df8af93d6c19966c7a9dc1e6d40c89684ca2565817d085a54edec8caf7ce5bf3aca272e48022d5879983c926614535831474c2c6aee29f4a5f4a63c9522f828897c97acb74abaf90a8fc6dc2c159d84c900b90c62cdd73ecb23db25652b7d85bfd497115723af5bf73549a34803a7f661fd0420565e65f0a94184ec0bf7df3df2f32e5eaf9c9a374922a53d6240bc58d93", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], 0x28, 0x48000}}], 0x7, 0x4040) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r9, 0x29, 0x1a, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r10 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r10, 0xfffffffc) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) r11 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r11, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x14, &(0x7f0000000140)={0xffffffffffffffff}, 0x111, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r11, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e24, 0x0, @remote, 0xf}, r12}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r11, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x4e24, 0x6, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe89}, {0x2, 0xfff9, 0xc00, @empty, 0xffffffff}, r12, 0x3}}, 0xfffffffffffffc9e) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x100f, 0x8, 0x80, 0x2, 0xffffffff, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d38, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x5, 0x2000, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0xb, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x80008071, 0x6, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x4006, 0x6, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0x9, 0x10000, 0x6, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6cb, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x1000002f, 0xe, 0x312, 0x78, 0xea4, 0x185, 0x4, 0x7, 0x7fff, 0x19, 0x420, 0x401, 0x6, 0x1, 0xff, 0xffffffff, 0x1000005, 0x5f31, 0x8001, 0x4e0, 0x2, 0x2, 0xb, 0x4, 0x9, 0x9, 0x9, 0x9, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x2, 0x9, 0x1, 0x3, 0x3, 0x6, 0x1, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x80000009, 0x0, 0x2, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x5, 0x8, 0x2950bfaf, 0xffe, 0xa2, 0xfffff800, 0xa9, 0x5, 0x9, 0xac8, 0xbf, 0xc, 0x3, 0x19, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x6, 0xbb33, 0x7, 0x80b, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x6, 0x57, 0x5, 0x3, 0x101, 0xf142, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0x8, 0x80000003, 0x5, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xac, 0x8, 0x6, 0x10000226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x1fd, 0xffff343e, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_PIT2(r8, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_PIT(r8, 0x8048ae66, 0x0) 7.402155536s ago: executing program 0 (id=3869): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) r0 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040)={'#! ', './file1/../file0', [{0x20, 'cgroup.s:\rt\x00'}, {0x20, 'J\xadS\xabY\x04poOT\xba\x82\x1f\xb8W\xa5\x1a\xea\xce\xa9\x00\x00\x00\x00\x00'}], 0xa, "b524be350e7611b133a163b4ab1b"}, 0x49) write$UHID_INPUT(r3, &(0x7f00000007c0)={0x8, {"dc5d3b0169633d3eba3eabbc09167be55101d4af4b22a373236464d2dbfaa84399b77bd438a54364a7ebc5bdaab4f9decb7c044318cd59a0af8279bcab35dd7daf7a0ceb381df2c32eff45b13e2c8f40e1895355bf6f165200cb1ca41a155730ee2e9f83183f9fafe029d0401b0770618254a8b2dc87b630072b1e2de160d1afed51b74c14b71ec1b226a324482d14ad586b1a4ce80e458fe45244c01eddeddf3564af838d6d5324f8a77023d6eb7aa14397a0e1413ea1c3dfdf0e3a35b709e627f36fe403ee3117365be5017682f53595f28543062c740a94a794312f5cebc315044b8ea000a5d0f27812ab0ce149d11e6f6f7620c5f3e250bf67d13a1ca39dbb7b8b5a31e3d7ba7ebe5849a7a09b61fc9f2cfc54b89e9cd0105bca49483ce55e0187ce2ad692a18219d881057c838587b915337169ee054655f26a04df913a658fccbf4def6aad750ca4796b74d322c67e9d4ee6a530a22dcc35db850b424d6ec9f62495b9f9fd2b000feadd57d26dbd505798c208d91eb0aab0fd97537631b8bf81ce0e2241c4272be4ff69b390e4485d574146b76d1fdbf7fc5334906805534cdae1e47240af7761a18fc8bd0a694be47529da98bc0f98eb7db3fc4a74cbb6e486f4de90fbf2452e72c2e1dca44543ad9ad094b8bc861eef1e814662d0b350339e3a510d459c6f83aabd5fd3dcb38224056d761e7df9b482b9905f1e2135c1929be328ecdb69c007a3efd548502c83106f6df1ab1178fac499eda92ad4373155227ec2df150c919d322ecb3ea37e659285f18a3e2f79b59900ca438df3a1381380a12d3ad7678e0a8d3bdfb40651389b4ac8c66138d442d70eafdc2df8b080028006b1794146382c1d628fd2ebe5859b6c243824903d056d800975675bb1913142adbc039a9c68c2f146a0e8903447313f5e5549905f397a9b1f21a93b80c4d04a8ea7a29a50fbc5407a9305bba420edf898ea678d6879489c39692c99bb6dacf61f5f97637b94c1031d635b5423b38b9196fafaaf87b2796eadc21466af5a10281e6a808748969d29efb444c99a4cb2111732a792dbca4376a125a68f7cdac065cc6173dc21caafba48c742d9a7df2f771ff2f5725b22c247d4e0c6106f9f5f6929b69929ab37e9a9b326ce618bb702b883b12026f1300f21f2c7440cac8c5f1210a78aa067211d2827f5dcc7578252c2ccc3f67bab9d1bb6939b21b550788ef550acfed4bf50c0b4fb3ca4d2872ee64f95d611a317d9daaf373a10d868680b2226396c95fa2b0ab4d6fce06c3b42cb97d17a7b5089061537fdeb1a53040869f7befca330358fdba86754fc2e46c2113e1484cb37534af8f0408a7ee313778dab49f08229964298f847ea66c4ec319f64b6a12da585bc59e82e0263c507b397d3efee3b4066f4d25566aa1549f6185f6375f84b65fa8945148b90430c86a5b6fdf58d5c812b98d9dc621fd9a3d9f1a577495356516d1cbcf5e8bb8923b54b247225b9c3892b18a9e137f3620c734052af9dc8f1ea36f0d4592d5ee32e35676a84dc891f97456f2ac3a4ab58a42bcdc221a4ac8bb28d428add2fcbe5b110a8afd5d23b31e827bd16167b2d88cae024afc04a722ac0b4d45c52512e6b6f102aac4be21bc89ce246539048370553665b0a4336a6db99d0d19399be6437bf21419304331b4342b2c1db580f0c9bf681fdb8e9fa3e025454197bbc82ef93ee2f385660818ec5127080675a8013766469afe3b1e36e81bf2f04c3a26eaf4517551e734d21ba3bc90e48aea0891792970c39f3f528397e9b7ae190f1760fe5960dc763ee0a17939c60bfcac0a8914be82c749e4fe85d1ac5fa733413468fb8941085e8c4d6e0b6d1e62e20da58440facd640ddbb6c1f694b3ca48757a34c5a11668368711a1d4f3a81d31ac30d71277d7ae77882b6841cfa6289e6cce84a3ad57eeb328f831888ac7d3cfcd3a472a48d903f20cec8c8ae8d0bea04ebf7413ef7693f8ed876e49bd5f89d7e1078208ff62712e330fc0341b9ccf26845578d44b1e0c66d1bebc14742baedfabb8e9a2c8f42730360c72997efe0ce786ff330c2eb6e0ff20896f813c2a515ce76f826c11a1c1588eb369231ddeb4a2f9f9591ecdecc74d20aeb50047beb3ab89a9e4e1b805a20b645c79d0bc5d0247fab8ba46a97a07630b1f1cb69b42b568af746063d2c581f057873d64fe6e659b00b4a26745f5fba1fe7406a86b007936c7cfdac53a4c5b0ea9f6604863c8e3f174eddbb09175f6e13cda9a860cf400ef9ed02b895502ac6e6de6a658249c3c6e8a653517eae2231e56e0f120547923c6549ebc1ed14c623637ce3d96af5c93a32e58e2d9659d8b5b145888b52d9a5b5cb3cdf594eb137bcef2ba068cfd2c6ccf7ab6e5b4ec55e9197bfb91c9b8729f7b50cf0b0326f7ea3e712c77674d48545ca2a86744c3c38f149d69cf811beacf7e5f49c7bfba20f1dcf3d7bc0b9c796016820a46495d244c9606a06fe2e14233eda78d69ae4523ad7b708b0c7ead44d7fd376fed60e3cc2ee25e9600adfbe87ac7c8fb8269aec9459602af0f420becda6120ce7d9626c65ae7f860639e8bf664eb4301ec18add0e436c0356c12ab6b4ca35da2b43c4a8c239fd0b59a2ce94843cdfa1667053165053633b062844dbb0d00070fde74fa3178eb5f1f5fd02e2088d8690379f39ab22c080cdcb29d700bac74fabd8a356fe99afe83a5d99aa5024e9158a299eda6c99b6701e64f1d68e7e2c0c6e88396bb535a02d0948f0a250a6e090041c96d9c9acd6134d44d516fd1010c39e572b86b05bb1326a2a4f23f11181186f9c2a01dc7b58c0129f4b851ca9b1e3dc35db7364e29ef646211796b1651511e041345abce427fa5d6e48b8fb078c8432061a4cc518a8f2a2caf709a5c1473a62112a6650afc64eec12f8f9c08cff1b6fbf7a1209fc8661f62303b7c5d49c1d0b32a9f37e81ed9ab6193816d40995ed49c10b9f5752e04d57535a3d16f06c65d32846c31ec9787ec4a965679eb804e86b45d007f38d8104550770dc6f313bc846e43a14a8c21d0628c744e3e83cb998d1b7acfe996541a8c03852dadf9326444c582b481cae844e4f3fe3d638903b38f24633b63adbad841ac6c4c5169d781a0e271e8a967b1c7e986fcb3a66168e86e3559a44fcfa92452260491da9397659af60453f4cd4be2d15439445ec2b4366a79d3283da912d9d499df1242bd174edc235848caa21d2c997aff0e95c7e5cc0803c90fab84e7be7b37909d0e2f3bc9974e3388acb6800baba183ecc8eea8c71c0d65d669e41f99ceae523b7a6b772f3b8ebba1d2127ccc3ddb7ddcb4ec73cbdc26fc87c3848e258a0b5484d3a13e40ec4e4a65dd92f09e9fe1e3e2f8b96c4e363aa3683860dee62dfcf8823ee4a3593a092e0bd9c4cedacf44a272faa164447b01f46a7795642a40c61b0034a37f0e9b792428a0ddcd144fe8263088eaac8016f8f1cd30b55ac90a8f10d785b7570dd9e639a4a068d3fe98a420b9f72e79de817f676c2a224300d749571ad43f49d1fbe838f4566bc7b5f104c384ad87189213152b644d9fcbdf98bafeee569d640ce9045779f1d90024c023a7480a358dee276fba139c14b4fdb12885240903d0e61dc161659a68f62c92b899007e0f2b65bf0a069e9e57c9b6ae50a3b30dd1003fb0eead73ae2f6010b3b356b4060579a4f29935e1f00c01d12e5f44e8e3163d81dfef7ca8560604240c7e96e4454c6971614df306c768121abb3f628e3f1d2d026f58d1087334c5bdb74d7c949b0ee66a4531ba4e9b922aee3d0f802ed034734507a5913c52966f1f8bd4577840de0253aabc23299dced2a299859c07af9fb0f9c29b6533b9d84d471390d59ab315f5ddb226f6b8dd7889295f0fb1f7bd1adafe4cc520a1e84bf2a59d5b9795aeafc8d6fd66a8228aba8653b98622617ddfeb5d6795c9bd2f35d4a0c386e862675a50e3314c3fbb17aca151c13c7fc8b1d1b72ed0a958537b5ddc9e74bddc2b9571ec3f2b7775b125338d4852a75a60000564c65bb36dfb6bea4aab1ae7a4f285c2177aa98406eb2cc10934aa92d5a9612d4455c84ad200841d289b5c2d5deab0d8e2459598ef183d3dc47f6bad0b9513710600cfa4d69fcd5763cdcc4f2c2b7cd7d4491fd52f4aec82ce846c0988f6f0123e21e900d39c61085e68c9badc350b44004f6c042d64b0d0cbf91ad0592b198f1eeea1e52200bc8e6d62848d6884b10bdde72466039da488be6b340c23148f666f2fe6e032c07dac43586df182aca9116f4600313fa8375c76337ba86bdc391dae6450218f58f047ced64befc6bb5c2a60024669630a6279fedf2fe45e7e19ce582ad96ae0d023eb9b39f5f1e666e73bb038ae38157275be5eb3e7cbc8b05adf53e817646bdc2cfce98e5d162bf7faaca787db8717ab8b27b9e35609c5fb9de9def07f010df8b43cf5c96851eadfdeff0b7bc5826e7e15490ae9c3d14166ee81bef007070e7981235a673804ad89943ee6b51ac63364f7870e121e6ff23a0c7d179527cd58dd7a4ca37247c2bd9efc79b720bb1ee2d39862e98cb81e93cf5b48d5d02ee8ac737ab504c867a1c49e678300803c94fbe978dea918a1e71b9791ee1e4d30056e86c26a4675a8b090be2365c0b451a13ece52a89a7057fe2052e11c6666eb916d823ea66bf217c320acba3b714910734b2d27c2fa586bd7f7664b0d1422adabad2ce2afc10270057f11940fac1a51d023ce48bd04ea39b7f99381b239fd0ddeea0dce7863ec1f8f61775013b6414ecf86e686a340a3148f87a9d7d60a1f2da53436d16fc88d6a4e7c3d55e0dd004cbecc15a5558eb705d82aacb1862ddc251dd5d9cbf1d78f97900ce6e8dab0ea678cb823bd1e7bbd1e927841af08f5427878c19f4f322228f9b36287fc13e7c1293ea875ae73815e052d6c2ebc40df8f7b9d1f76e0b10e35aa160944983d8e6b790df0d9b13f3460657336d81f7d83c0350324b930ec9c7557ce12887f76372e126f504b0980fea27f31a780c05187b9b5353dafc6b101543b24332b96e15bc26b19062e52fa9f86d260ee3a3bc92a133e328407bb85357ee5c45cb87228f44888b14941b5911b050e9319fe88033f830a8490917a9c0572ebbc549000000000000000015a34abef947b5b9a950e780662de18873e55899c92db3ad00437e8407890afa6b0c04ef861b8bc85fbbe1bb67b3d9ef001409f84b8ec4f01d861cecc143a805b981ab5cf5b605057b63cb2c84ec358e510a69cd8c33a8a62fe4680d0c980145cc709157832bfaef261cb00800000000000000ce9affffd4b1dc7cc9511da0b34bffb9ac216fb8cf7c6572d95627787720d1ba67c6512fcdb16f6329e9668681c404efebad559f81f05971b5efb6b4cca97ad0346753cc0a40a877242d8a808c602b03dc962cee38e646cb18abb079c70d357c30738a70f55cd3c5956a83a1bfcd6649dd765f16bfe968066345df7380bbc0c16b3b5af513d6458c791343952f33a051c5d711c1f35af1b47f3db9bbfb5c040000002b52805d606479879be0b404a28ade5649a3185e0f85a85fc15cd824671c2befdd0da509597c87d869f0bd7ad163ad93ca28fc0c4025eccaafe385ec3fc06c54ebcd7b07b6c7e0197c5b9ef886159a1585ae45248f865be760db6f5bc8f868fc6aefd04e34ecb51159e4cdcc2214b42b1ca9caec13ba3e1b2e7a3c736977b226213d265c2873195122a9b448088c8b50edd549be41c38ab176807b75e7267f86e400", 0x1000}}, 0x1006) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000480)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x8, 0x10000000000, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3e06e00d96072081000000000000002000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a03c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00", [0x6, 0x200000000]}}) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3}) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) close(0x3) 7.29531009s ago: executing program 1 (id=3870): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x3) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000100)=0x7) 7.085276147s ago: executing program 0 (id=3871): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = getpgid(0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo/4\x00') sendto$inet(r2, &(0x7f0000000280)="26b9a8dbeda348628b42c50db44a06af5d33730ed15f7a5b4ac6406a65de8bc6de384b349fbef214316553264c8d880b708e8a4627fcf0d48823d1a4c48c3faf789822097db312645cdd85ddb73355722960d8bb23b16adce1227c047d043f00fb35f469ab509f2b2ce37946cf164673c36963f9a1e7eb3c541d66dd36a5ef3398ce021bf8bd4998b8394aba303b2f8c9839f616ae5642b429021ff022c87d346208d17c557f82b029fb219a543b5fc928a1b71e4de5ff11e3c0699cbb33383e73", 0xc1, 0x4000, 0x0, 0x0) socket$inet(0xa, 0x801, 0x84) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = userfaultfd(0x801) r4 = getpid() process_vm_readv(r4, 0x0, 0x0, &(0x7f0000008640)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0xa80}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f00000000c0)={{&(0x7f000040a000/0x800000)=nil, 0x800000}, 0x1}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x15) connect$unix(0xffffffffffffffff, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e21}, 0x6e) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r5, 0x6, 0x9, 0x0, &(0x7f0000000040)) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_80211_join_ibss(&(0x7f0000000100)='wlan0\x00', 0x0, 0x0, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000024c0)=ANY=[@ANYBLOB="300000001000010881dde1736f6ca35600000000023bb169acbef50b138d9877080ac195d4721ee9585a75cb5411d6faaa73dcd73795c8cc14893050d4092cfe6aadcfd760eefe0d9bd48158c6619548841ae00925406f08570b9ed116f4571e2862de84fd121ce86d14aae261baa0bc718690e5d6ce301e7fe1e9a0a534f7fed7589b02123e9d3765971efcb3f261f13d12877c6040635d85825026ead42b90a10b380d00110c0dcb50b5c878f5871751bba9defe80063c4a4235359805c940f013144f5c4ac906f4f43f0d672fb91ee6e7421a3b67a43d9f463335f611649b16c74e9125df0a7a4c5660ada8e58ae15976b8e1b36978103bca3c89ff73356c709db4cd0312a505dc0762051074ea2cc92780af41884425588b6592a4b55c1ede49390bcb7b78f26f9dbf46834bcf949585e25627b7aee89ea2f4df3982b871ddfecff34ce6790d6b91ab17718565af391f5a46fc29eb229fdba4c7984fabc3df226d9b3cdfe05ae907a3057012d08900841e47396100859f58c6527772aadc7ba6b040bcb710adbe0f63d32c89d8ca40a6268f0f67ed04e8d7801b6eca8033efb77f6261a060db83f2906bdb9d83ffffffff7fbb4a1cd35c4f0dd69797cddd54eb80cbd8305d380b84cbe8644eab2afe5923c0f5f0c48d7345655f0d1a7f111d5660628638ff6d80b1419fcba35f881ca7d3354c2e7658809ecbad0716bb7f8a5d08e8fbc164c65d2353ae9435993e6ceb50f7a417c0c8cca1cca8226a3ddbbb0aaaf2dba430c25af2b9ce36", @ANYRES32=0x0, @ANYRES32=r1, @ANYRES64, @ANYRES16], 0x30}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) r6 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="124f4adb93bba613bd6b687f6deb5a0100007e9eb4104c053800f51611020301090212000100000000090400000008c53800"], 0x0) syz_usb_control_io$hid(r6, 0x0, &(0x7f0000000000)={0x2c, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x8, 0x1, 0x5c}, 0x0, 0x0}) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff080045ecff1b006800000d119078000000000000000000004e2000089078"], 0x0) 6.39500824s ago: executing program 1 (id=3872): setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x200, 0xd8, 0x11, 0x148, 0xd8, 0x0, 0x1b4, 0x2a8, 0x2a8, 0x1b4, 0x2a8, 0x3, 0x0, {[{{@ip={@rand_addr=0x64010102, @multicast2, 0x0, 0xff000000, 'wg1\x00', 'dvmrp0\x00', {}, {0xff}, 0x67, 0x3, 0x2}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1f, 0x9, 0x8, 0x8, '\x00', 'syz1\x00', {0x2}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0xffffffff, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0x70, 0x94}, @common=@unspec=@STANDARD={0x24, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x25c) r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f00000001c0)={'nat\x00', 0x0, 0x0, 0x90, [0x4, 0x80, 0xffffffffffffffc0, 0xfff, 0xfffffffffffffff7, 0xd], 0x0, 0x0, 0x0}, &(0x7f0000000240)=0x108) timer_create(0x3, 0x0, &(0x7f0000000300)=0x0) timer_create(0xfffffffd, 0x0, &(0x7f0000000040)=0x0) timer_settime(r2, 0x0, &(0x7f0000000080)={{}, {0x77359400}}, 0x0) unshare(0x40000000) timer_settime(r1, 0x0, &(0x7f0000000000)={{0x77359400}, {0x0, 0x989680}}, 0x0) 6.039653845s ago: executing program 1 (id=3876): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0xc1842, 0x0) io_setup(0x3, &(0x7f0000000040)=0x0) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x2, 0x0) io_submit(r2, 0x1, &(0x7f0000001700)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x6, r1, 0x0}]) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r1, 0x0, 0xffdd) syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f0000002e00)=[{{&(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000000c0)=[{&(0x7f0000000e00)="8c452c031d7d76a31d7296e7590ddb02fc179049c785a3f115bf2efa2f81c4c8be86e62a39e3c52df3eb50511414b52f6bce725d7e044f86bbd55d7de77fffb6339bc5d3ed6e3aeff3b4cfb24250ea809fa7fb745562981293e8d1e07e49bdc985279fd8ad23656089fd011537dfc4be0f5cfa95ca0a8e2420623e634f893383dcb17ff80cd6c26c4a7c812050cc817b8599b34769e307107b394ae7409403054a6926f7f353dda10faebf4cf044e4c8174077342ffbc80348c77f6f8875e311aa4f6f7471099e86a3162e0a9b04b9ec4c357872f36467a9ad57e84d246fe5ad11a246bd87d49a2dd07915cdeeed6e509a1e4a12d645e35fe2c85839ce2a5d21a3af074a310ec412621fdde1ac4d9eabfbe29ab11225e1e77926037f7ee44ed759c46b7e850192c0bd221e52873bc5ea7be8e1693323ca62a6dff3d6c87eb4edcb06f415a40548fbfed85cf750abd21e9879b7d81e7bb44d7829a1e01305a474b36226f7dea15072b5fa50162a065fca23571c202d846859b97da7bd64464ee66ad06b33415281c691fd265dc477ff14a3c18f422caea8c676f482a65e36350d9faf1b26413f97e33f2cdfbe968f11e0856d832dee15317619666296ff6dc0a96030ec440444c54a7be951707dd280d6cea30ce08220cd5724bb036fa16c74501f63e7998f02c1c55519a851d6d9cabcc2f6332254cf20090918583f346bf739c71b1380f766509accf4654e8fd5ed9856a97992036f82721fd554bf042f7468b586d7a251ad5f51a99abdcd4babeccc4744a54c09c7492c6635398b0d2f7875565e0077863b1805d39c5a6c5e4194a052994973d205fae49c1591951615845f64c47dd555951ed1c00f10fbedee07a08b43abee7c81926532e4f57f97efce1d510a825604f2b15b4509cebcd21a75bab4dc2de93790d93d9bee7a0dddc32e33b068947cb1679e9b7b45a7c5f648b7d4b59a237189da522bcb100c5e0754599608254530515475bb741b7b9a75c32bd0055ac5b74e9269e5acba4da0fab1565c884e9c19b7458d18d3a5dc533c22e8f9e9d3aa517c96133dfea000e9e6d9df1526e9ee2676327030b7c965488319340e7a3f50437cc06a99614c64edc372e798e7c51eea9ca2f626894ee0f0c4bd1bc09d2df8cb07b8570ca891e7e13c3058fd6e8e022c20a3f51aa57b0227787b801293a071d7bc6a9afbcd2cd62997bb62374f5ae37a8296185d047af73de2b4c08041ff7690fa377d98f8c38e8edf3cc56165f7c230f00f41508851367cba5dd94a063373b579ce54583b39e0973a860740c1a8f2d2ef808bd816f7e6cbb9b0e2c6ad6741b3f865b416c41c25baca9bbc6a36db910212d94c07251b273764661f7ded244572b4b9ae2f381cd9e0e0c4aa95a0718e0709d059fae2d2181117fac5fa1e1791c8c75f0b030d554c3a89712f87a905f9ec9014795369de5e9679f7ba6482a916dd3ba7a88a971a5f64b544c2943f67835487410ae682b3bde1c04349b53cf4a6a00b69fa1ae28cbe815c390d3a2485c688cec87ead2550e2bdbb07ed1bf4a1b156fb41adff32fdba379270b5472ea721683d0d0567f0337a65ff8554b9e1c9ece7ea05093732593afb6c571d750619a1c73d5a882632b590da3acb080da50a43cbf83a3ca885c1dc43ac33d22fa907aafaf192d427f595a53ed9ce275ada0a1cc5d8e96528eda78dfce03e10468b2a3c964917377426d51813a9d23b48ade2ca0e83a53f7fec1a9bbf2633847087707b49646615f43907d8abfa567e5e72ce5bc597e20df4e95de0f6d5452d7563b394422f65fb8649b41a42824046e421cd7682c6e23f4564763c66ebd28ec289c8da6831b1621da513b5d528e115c8ef041ed2e7f127b6a1cf53b792179fd204d80d5de59882cdc0bee0fba34533f70dced6431fe2067d4d253ac8979a1c1304e2c827886c7265c897463e51c67e2f867eea9e28a8a766b454213dd8e61d3b7effb48989e02b92861349feb88818baa2ffe5a880956631b71997cd0a92c9769ba737646fed54e12388e855be2c4666d01ade67648b8da253cbbf3dfa3c0677b4bd849e5bf04669a2e5e56fb0a1be524501ba37cec6af2f37b563f74f6f33a1407012bb1ec5f6c7d02297561c007e8ba3fa25f418b9bf502d199f12320297400765a04a4523ba24eccf299aa6b70cdadda4678ca7e47cc0a36f6fe5de3fab7cc0b3cf895c13ea65618baea1cd0a4f7ce7cf3b8f21e0e09b397ef39599d276b63a7d0c27a340eb0a89b9e16bb25811bee995a0d5bdf09c8f230cf86a6cd3ccdcfd07ba675798356f5bacbcb3bf51ff9fbd1bbf03cf31f6097f28fcfc83145bbe960ad372df338f29197136e180229c5930259fbff384fa0e1f4494a638c6c23c406987b371fe428c8299d653d4f8adbd184cfe32a51cec87dfdec07ac57473740df1831c7569f27dd5cd31bec24ef5e740a1a46fa4652879c2dce052c7cd17c56be7c9f89157ece1e5c88f9ec2587cd9ab833b0bf55a6d7c88ac664389ee3027924ef41786ece1b4e6d25778e1595c714a232a7934ab4ba8cb79cb0ad8b7fd9704193bb0a3de58a395bb8318b71988585e8bc1522f9b92d67ffc4ad4d4517bd7ec6219a0f537d419a3122aeeeb1831e8849543a30ab134d4676ab0b6b1dfcd74717dd7d03bb877e5433e4f7aabb3b8eeaa738a814a97de99e69812a8864e1489679883f1b4324f9b1c35fd24dd98dc4bc2b4dcba6306ea30f96d29c8f920f4a0323d8384577552bbcc003f38ec6bbed00b16aca695777b90b2bc616deef00cb2a0e074879e1781b51e261d124144a3faf3f78facc51cd0a7d2f60b0aa4df8a74e7f42a2e4fcff8ae8d0cdb99dae088bac4518f4a8df888a3fb7c959a308ccf1881e2e7abf84a3c90057001256fcf54004171b559a2148f347fa50f52b5e7d0112ecfc286697b14ee8db0e97cab96094399be500976520d8f58f9b3d387ebbbc8c97146e017256262f9175267d553dc1ed112573159b487013242245cf08258384e25e089c7c5d521a39104576ebdbaab19d9097fb4b7791b55b2232dba562f78a179fde69434fc3f259439dfb3d6cafc58a327a5d295ce881a10ca97f7544e16c9cfdc80fa4e1174eadad8db210adede35d3124075f30475c7c46aac0bb848bbd8c57d033fcbe7d73c6f7021bfed8fcacd60e444b9942001dd1b23a0269d023a04c66a6fdf5446ea1808d88b2c4039ba9986b31db24ade18f321b3135f9d1dc8234c040049d0850a3cd1d06992de4ae7657f158dc7e5d11b6fc6ebc799e34461f2c58e2bc395916402b163d2a0abcf10b2d23e66eb91f5d7ca6e02b14ac35b752a62b7e2616334f357e797762b04c4674c057c3c3a85a1eb0f5f5adc55057a6f6dc629dd1e3a696ed48abb06b54cf3a35b789e1434136ea19a6f9bdc0e6c55bfc45489ad5e0d5b0ed6d8cbdb4742af8e0463cb2c81260b7c3c70690e312eadb65f71431ddca6ae719a44feb6af283dd3ac0c72e7312f2378de9a918abbef7f505b0da34df9ecd948b4173f155fc3a7f22f6247c79b1d65cd6f4f18f66fd376f7625152997608303d36da40003903e8c5eee181ce76c9843f5841d0d1ac21e06bf81c0b0b920405aa18335aa07f1e6d28dfcff29a78c46037c79d3fbe5a9f90eac7d906b4a4489af0428cd82d0c3ddd385982715348933c635b0dbb07b22b1fb605dd008e36e33f82e4a607dd91d27d1fc6baad44dae9062f6fed81c802fb1d454934b075867616a65b1184caacaa05bce0231fcbf2ad6fe813e4dc71ee855d22721efe08904901fc5284eb467317afee7e155d00ff6c9cb30889ab53c6020b78004a43e351e48804938fd83e620e4d7fc8b6a29dd264a8e1b4bfa0ee3907608bf98c953aad0651c609e3f10047769a982a658d580572072efbd844fa6b8f3c486b2c48dbfc975d8b61a92fcbcc39d0cf9b8af6242e45914a4d017137558719b194cb617c1c873e6e1a301df2dc8bff163e0a5d80fe977acd6e83e06558c7d946ee5dd332655f9c9da737beffacea695e4bab1ec049c549780b652cfeca0e77e1fec4f151a78e7e556c3399e848ebe5b93db8fbb3d914fc33a498b9677aae9ba06ccabaf6155ff44301405714a64ce282c55fc1775b5792856d47d81eadf00cf7816f4ee3618312719a77b67d1cbd9610f4b184ea998520cc6a55353509cf8dda5135f8bf63345ff49ba000d7588b69577d7d877e69f3cf9863ee6b2d43dc7eba45f194c1d83bd27c6b70c6553b2daabc0397a1ca4d1ba8ec35a5c0006c9d355fecb412eb656081de07c6b38b3c1b1e41ac3758ca0107139afccab861fa79ef2f40dea7d3cadcb72c8e4bb72060925bc6be07b392ac3f001c09acbad9e15bdc5b24e258566dd8df2ee4ae98402900b909a835246e50cb2c0cedbf2d2dd323e2cbaf9d4494c8790280524b666601b3d466c28092681b2cced6973c0445092857ddd648c38db7dfbe1467fe383985e8d77a705e6533ba7597bce041ffb1b33737aa5ccc1366c0f547d5114575e45b8b28667af3c296769ee76d7f557e68a83c749bedf540baced90705737232c60887ef5394fe79d3a86a63cfe21d6802d275d1b38b2ef20df57f992ba9e8b817d849995fdd65bd866e4824e66047e2b4db994f1dda029f31134f17fa7021eb33181c8cb3744ab4125702148968b3197a8e48931f8cef1ba9ae8a0ba629d4081a6f48f9b8e6e37c7a3873bd6bec2e39f028c11d545353416099fd060a00fbac024f7bf406c1b13a5ec97506db0629a804cf66482535f1102106ae568eb51c8bfa67a3f27d56a6c172da5ac35081c483bbed1b65683124fcafef599ae807b52fe0d0093f95e833c9c22532ac2d97476491005f2ec5d74491cb9257133ff39f40ab9c1c9582557b8c5d2b096e533a3e433ff3d26c272a6b446a25f5f353a1183dc6548ef5b153e8a919ceca0cab9e2dd9ac75a3285b1e4ff48f339dad640f39310f4eb5f897134da54e648804077281066608e4411ace2c481e0a81babe5d17c5fe7271a944ce5fed39b7341c8250a556f502a5f6dde86d091846b6f7af2a688a7206f7a0119c136e849d7e226f9595014cf7ee023ea97aa454b60bef29dcb284741dd37e21ecf41d8f7b42e93cafc0fb189f84dae0bad39c9fbf4a530ea1bab4e51feea7f55c8ebc1228194852586e7e867456d3335cfe7a8c4f9186529b38e5e34d49e22370e5b6a8eff076a495c28e103cac646377418a369a046191db30878e91b968d7fafcb3e196bf6300ff21cd13cf7ee845209a0f55d62e89c09ea0a445f3c7382fa8bdd36096f3cc8a90a65d46efab6cccfa177661f88ddf73aad6665f944c1e98b98383af04ca598ea50eebe546865f556326b36544ac5d164ce76661f2314abb0e90c3bfbdf1ee3914dc7f6d3be60c973a0f19bc12be398ff5826c5f7df1f88bdc6240b282aa85d9cc926b5de7d8ab2b3f8f20630436a9cb584eadd996904de0a46700139ddaf25071be675f0e6df059248c2631df933c595d9bf414352b374f2b6fe6f4a2d3d4bcc1bb35422db30d34e577386a9c34c072266188edce6d0eb916d878b3ff0dfd7281d5290da46b9d3577b24550a6f5fa769f41c4dd8c30b32514b2a054aba1e067ba833457f4dade9ec80b1db98fec4d191d8b1c34b7c1fb3fece10deaaf9a7e0a85215b926159306a53a56cc3b931dcd33fbf872e4f2e405500c3d99b93a5ba77bb0e6866bfc311f5dd4a4e1507180a4d2ee6ba8702dc08b5d0f084df6fb2ff9754902759345f5975", 0x1000}, {&(0x7f0000000440)="e8b5b0458f5251a3d3fc31986080e328e8871f6ad8bccf2fe102a54c16dbd0f17350300f9512fea1ba12df6fbe79e4dd85ec083e1c4d5fb5b6bed7aa1b0cec850b945799506736bdd9d0b7b1bfb812c5de65fc168cffb491f7b92c0920bc35872daa9982fe254c2d3b3acdc41752518eecbbe16c402a47864229eeaa4753fcd5e9bfa4560728ae7fdcd1acb833ba2d2ebeef36d924054a47e0228c892a9542c1928f32a9379b5a646266116df9b1515f9fffaf81226f6854469ccf3b2c851d46d3d83fa6879b11908b8af4573d676e5d7b35ec1a436a05a9db437ca04f0a4e5bb330d57195ced0c3dbb492b8968bfa73a0f43696a7429cf92028", 0xfa}, {&(0x7f0000001e00)="4fe0455a0df9729e38f8d51b216d8e0132fbb391dc813bd636b098937e68fd9277f7442075669214af222fc32e213e069a5e80f63ea9beb5a4fde3e8407235d3e52c4a2131491e8a03b3c1a7e70993b9accfab43fd8390ad2ce6a4f8c0dd4febced1ced79d9f8b0b0f6b130ee8b2b8e582fde80ad730724f9190a91513e5f9033967b7000c928afda4b502440f29b1501f34ceca09b13fa8988b6558b4d17bb11651c62154cfe98f452baf8f909ab63ddcdfa5f43273bc703d57b1960754d0b4b264f0ba7b944a65081089dffe9a430b30b61a6e6a78a86eef6c78aa147978f452945af451ada674b25aab5cf48ed9a76a36dfa614815cf119dc9a91d4fec76318104abbd1238436948b30b04b012a0e0a5dcaf4f58c03f8c0948b377451d7e2a79ebe6dc2b8557b96bddee8c2bfbdfe565193d8c630dd4e221789ee8740171b51e874870e48f7ec9b5e85e6c4492705c3690bb9d331e1731a2b0df506417eba0ca6b860f34213e2fed0baa02a583ed0cff6ba55f6077748da3e4d16b335c993b67370383be6c5854d334abcf583a372e817eda3094aaed85c596bc01cba44bd3ca53f6221a301a6de56653610659034c3db2f2c1d6b5ce844d62268bb99ba7372640d508db572e1bd0093eb64cbfe1708af3ad97920ea528eb79065b1aa5376c55de5d95da152cd7339b459cca002a38a9455ed848357de0f0dbf0ec306fcd358bc967ea5c4027f608230e02da33af3e836571e9311c90bd1a51cbc3a4059677579ba452ae2a74762c53d667af1f227ecf5fa729d9729eb496680ba9c5477548950c434cdfdc68590bf11a917214c09ab7dcd4af2275166e894e88bd1e77177e508c419b246cf196cf0472f629543b0b5bf3794e22e1949929764390827ebb5c7141730bb891c266b09027b37f23c63f23769aee1f99b6983311b8a2e2a56889e33381fec27d4b28c1e0152c9af74f08ce8e83ce5b2502e8d824e25135f505e0591b3cccba9776b5357e50b1b737f3c705a6fe580000503716780a6d15dcf387fbfaf466b041e8f0790fba08e62fa72ab9427ee8a9d49eb59d892682a485219f451b6aabc6d139c09bf9c4fa87a43d9b3fdb0c8f2613540d612193834fe58ed58d8f0d3b2dd76d21c5b851a567e4b891d90e725bed25096b4db6f52dff2e645bc47e94b20440cdc45f5c3754876fbe28b68f6d9b529eee0622b50e5a8de856519f6399f6d765ee6f21945338cfbf57cd4affdb9a6b63e90adf727bb813a77ea4f742dfa4d37aaaf06717f26f8c62542065aecdd6099d73f3df4f889bb4e0d8e4c67bf78f6d9e637c80817e0d3562f19f2aaed0c50cd9befde9a130794486980974549dc7ff9954ffe4822787e512f1f55c0e6aad443f151a9a06e9941e40736b0e192aacc46865336bc23762a74cfb84f6d62b89019dc7ae97250185ad31f3718ebf649928b442841be0fa2cdbb7c15f4237dd416195557732c2757e962edb63dc04d3d7e6443f2ab69fe7d043316609c92b16af39d300489acc036c4a9f511e7026945c711a0c4d068343cf3e29670da11356ece78221ce90403867b4449549e21e79c9db8a94f63930c7e89e2d26d9b7114ccb037812f8c0fd58073e6636bf58ff5279b4dfea156eb5da2ad736164df49e6ca927622f316872b1b7b701baf92cb8ebada271f68fe4f9d10aa0858b90c1ab1b19f4840cfcbb093e8c745cd1521b6c49f5220e707e025c9769dd7f81f40cfd92b0b984228e762812ba06a07f7336cf0a234f0695d5bac1ba58b7e47fa6d198f74a468b00984524652a080fd6eeb878c4fe065cc6899eac51ac7cec4ac1f0127dcfbe3b9d1aa90e422011e1982a6a7ef497d8d84a9af583843cb689f5e10ada5ce3e8368b4592c10cfdad36b961f4bd91d6f122d3795854c4f99bf1ca0a50ff1f3e211fcf99c62d05f8545fb8ac190bcf2dbe2142cdb8654ac00be1dfc524eead9fed3f87f617ccb417ce1cf2b468c44c7aa27099e8a12292cfebf7081fbddb4b4faece4b27cc53d3d9593b81dacc994070e9e5367e8d9fc74927652a71889a543e4c90781944f3445ee2f6d72af45b91e27fd2e32e811e420e4bdc2a2c51f6f6a5690b195fe07e14ab114c148936dca2662b548489966897af2c6ac0e51204a513c0b30a7515435d7f4980c94612c91864e8b9f78129c331aa9d099ef19d894dd1d7b54aa02adf25a62314f5cf169dda7d59133b819cd096374313e6f438d52c48c6fdf2e4a1df17927d29f4f3fa3587114c4d79f707da23a44aa8bbb03820469364b8d16aae69da722b9f6358b9c58837f27393eb8ab049e1a015af0ad3f64d30b313a885803de3d0fee745bbda08c693e41c5a4e960f9cf7493426bbef8f73865db2c924a4b49eed6f4d0578464237bc59ab0b41bb00230202b04922fe137637f30bb3d6cec5f77b9dbcbf0c9ff2642fb8d186a14a0cdbe28c19d09e3c4126a55a92dba42be9158064828b832bb460bb8543207815ca98ebd1279a1917a385c9d85a85ecfc58204ea0e763fd9e0da24795c742ff6ef64e0df4c5119ae13dd31ce8e5a6b29a685fa6077e6bba6de78e6fe058234cfcc238f315b508f2bcb94e84017b91a1b9bf8aacd7c2872db332f86b4f5cc3bda66c37cf86fcc0c69cf18fcd9c5cd5bf2b7d043bb411976428fd2e4ce02b4260170006475e7651636b378546738f8e3ce9cce06bd348400989d88e2608fdbe9e09046a9a6ae4d8508636ecaeda7f61fd0fa2fd3a2e02962b79715664a9213c117969ae2adf29476667658068cc2944d16ec1087761cb5c623ecd31346945c97c3c1986036d6d81d3fb4d92415f40c7ae6e0e24aa0f7ece395278cbd915f47b8cc6bea901776c92396e66f41f79c07aecdbe993e22762f256b258246fbf0ec9138cc39147b3cb58ec97e24beed81de097e2b3553104cbe015e6832052ffdc1437c0dc669b82319abda1649cf77af9a813cb016d4a4f3a3e4fdf5f2f79e88605380a415eb717a8a7a9325856c92e59d1e8f103db81404032e39fa556688783de0f725d279145531324ed76df06023adb7d3f3ca6396c543577f135a4ee69af112b0d8004338fca3c78eea61145140be2507d10a6e7c45fe8c2961d4838fc446669c7334737e2e9b2ce4bb004cb2d7a8bda8b43dbd9ba3272012bffad72dc6014cf91b8a2a89d00c630588bfdf44801cb59ba1fea74eaa3296bdcc1d1866db98f6dae0af56dde263aadb8c60f198bef191031559c084e8ce4d88b96235dca751225fcfefba6926095f07a3890177b62d597d9843f2ef462d7f8eefc1204b05ecf2a94ce95d14ad56a2c571d288af5cb703010e65cdb1e0db4b6621210123a9b61bdde63fd4e71d95345f35518f7c46e7301802a8fff9e7ba645a6e4afec80614940df4f01c05661db241172c23f5e3e467867c2033f0fb10d710c7bd6bf5e3577c83f783fcbfe7556e2313fc9a659fb40cada982cdbf616f7ffbbd70160a1e7b998bcb4e02dd4952675c425eae485c20381e6db7f0b597a4debcb7a0cf4f66fda92ea919b3a401b95dd48a14611025a9d0e9c722485e0dd1a5018d6a206f206afc46e14aa5569b303bf92b960bbf5cfa69f00ab3523707441a42f1f3aa83ab8009289ef806b3195e35c4e0bfeff870f4680e6f5765d61fec2c4bdab6cf95d44ef11a16f879c9c8636d336814d7145880d3d38b9689550191ebc9512e64e7f615846eec9f7d447b047132d663199e2b5884da7724614a1743005ae17c4d8069d820fc5116233caf7583e27e2c3780a60f93bf42480069c4677c1a741d5b20b62660744de6d8560aa6ebee5a96351b9064942c9acc28ef62cc5264150b9a23c6f235b0c394f3484adb02a5802a02fca83c0ba9c9846207e1778c62b1a9e627863d175ef0e6cb45e7caf3c72aa700f2fc1ed09df90caf79e75838712fd8fafb02385aa8e90b5a4402d45f8f63a2bc602d4572ce5050c7eb5528599cceaf25cf06c397dc257e3180d23329d6433da5812b6928bd665b93aada3a70f4beb8ecb5f9bded839999e036e382f2b50bbafb4fb28ae99219be4724fc5e213951807bb2ac4e5ab382e2746cb8ac6d782943c623d888199ac8ac236512c98c2b950c3fc0ef4db753ca328e8854764aa4e4e2f403aec355b84044066a6a2e0373a49e783d6c99b9dfa9a05caebf662dededfcccb8d8ba286eda1a98b931560d0d0f5bbadfd2ac427a6c6eb34585972b88b6a487e10bf60a3759c38dda02ae3670ef7ff309103c490099e589c92594b9a48ed59ec90bedc3947e24d7c656bfdbbb73969de34a78a2c821f5cb97ce567b4c6eca3e9ab00ee6032bb7cbbbb481cf1d007aaddadbc6d13d1c532e103dbd849cfa7cf782ef010000001533c925b1f0e076128c0c7fd598d1d71a009463380efb091fc9125fc9a6b5a5e2f8ed0788837f1f2b291bbaafd0cbddbe15e35537574dd05c40d7ad153f6566d41a7bb0d3ee5e6bd4c672a3e1b1b792ce5f3dc3478d6dea8504b0b5585c26aa3009ae7581c2255ab378c9519fdd6bb1ba0ececed7616c887bb3d1be3f6c457633f55e3fab307f1b51e3c3cd5d29140d575e13bda389e47028fae5375686ba9fcdb9cb8986f20c040325f1b92bf35c4e7c003c508690b59d27009a19a3fc8c489a4f4d30a1ae2dc1eaf655f06c61107b567ae16d42ad3551a9b12d48dea53c9449e52e6320bb915709ed048de5bea9981fff1596b626504702765516e76f9ac17f5a1087ca1f3645e1a47ebf079dd2eb5f5a1a9319671b887605882a4f7391de8693e8ed9caa3dd3041acb4bba7290c00027fac26618e722dc8b56602c7d211ba4a96a0cafd425fcf52b479a45f264e39855ecafdaa9319b1155f2dbcc9f181325793a78333c4b26d73bfd6da2dcf6c08b66ec306736cddf55032a533a32f72af8df0a2cef11b3ec032e602019f2ef28ea9fae0aad245ac2e275bc4ce6f7f1c131bd70dc4acf1ef0b0e9ea33eeaa51ec2e560d41d32ad6eff907d3b40fe334a154e76a6b54f9345416656c33d283a52da4480fb35e8f9c2a8da2cf0f19da3c2b130fac377b4fbc910b8884d98a5911aa478f6ac68ea97135dfebf9fb971c176c26f902c3cd2716d03b0c869260e709804a487fa4416eae0be4abb06b839c1cf6c326b0d96fd4dab1255a5001cc179487aa1e613f69e81807129fcad931bd9d478bbbdb7c91831861cfb6671d32699a7449b4e727914bcfa2f4781b877b4a857916627a9e9fba2044281dd4c7739d763213badc72862e456aefea9ac7145881d8b9786d75b4e756f90871bdd923060fb53fdc3441843ce10f2ddadb755f7e59c442655082f90b902e8954189efd9e89c0216f80b869b7b9a3f4609e4290155581f5dccb8e04f8848968c25973917b94efaf23b542ccc082b007e723aca018f9d9230388bbe3deabee0d51702c382de8948926cd50c15fc0e58bf1bfdb6045f8df641218f0b89bad755ad0a524eff46b946c624a885382c43ed0d5252a8eed2fa3d0987921536f2f9902399b1ccd94177370a494f286a426836353a32fa609acdd6cd98182fafa4022f5172cb098db56bc47a15291a3e2cb1bd725cd4f8dcc2b1acf5a3cb147c791b046723823244e36e5d431f59405bb43974ab048243a057bfdc6fca8781dc4024a85ba35543aa51982ffb43ad48d9b0932855fd2e9574421b35fa9e8e316a939d73b74752167c361f2192f142a2b2aa7a1847b30e43e15b1af395be7b4f4b5de91def2ce411e86d5e0e8e20d32c5d2d8da8d931594a588a58dceb950a45380", 0x1000}], 0x3, &(0x7f00000003c0)=[@cred={{0x18, 0x1, 0x2, {r6, 0x0, 0xee00}}}, @cred={{0x18}}, @rights={{0x14, 0x1, 0x1, [r4, r3]}}, @cred={{0x18, 0x1, 0x2, {0xffffffffffffffff, 0xee00, 0xee00}}}], 0x5c, 0x24004054}}], 0x1, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r7, 0x0, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/fib_triestat\x00') preadv(r8, &(0x7f0000000080)=[{&(0x7f0000000040)=""/46, 0x2e}], 0x1, 0x0, 0x4) socket(0x2, 0x80805, 0x0) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r9, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @multicast1}}, 0xa, 0x0, 0xdd5, 0x7ff, 0x38fa8b00d923ddd5}, 0x9c) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000240)=@userptr={0x3ff, 0xb, 0x4, 0x70000, 0x6, {0x77359400}, {0x3, 0x0, 0x7, 0x4, 0x88, 0xd, '9\bC2'}, 0x10, 0x2, {&(0x7f0000000100)}, 0xa, 0x0, r8}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYRESHEX=r4, @ANYRES32=r3, @ANYBLOB="00000000000000002800128009000100626f6e640000000018000280140008800800030001"], 0x48}}, 0x20000000) sendmmsg$inet(r10, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8c0}, 0x0) r12 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) write$binfmt_aout(r8, &(0x7f0000000340)=ANY=[@ANYRESOCT=r5, @ANYRES16=r4, @ANYRES64=r10, @ANYRES16=r7, @ANYRESDEC=r10, @ANYRESDEC=0x0, @ANYRESOCT, @ANYRES8=r10, @ANYRES64=r0, @ANYRESHEX=r12], 0xff2e) 5.635587941s ago: executing program 3 (id=3877): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @dev={0xfe, 0x80, '\x00', 0x36}, 0x7}, 0x1c) socket$kcm(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) close(0xffffffffffffffff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000940)) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x2, @in=@broadcast, 0x6, 0x4, 0x3}]}]}, 0xfc}}, 0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x20, 0x4001c11) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x8) writev(0xffffffffffffffff, 0x0, 0x0) fchdir(0xffffffffffffffff) syz_open_dev$midi(&(0x7f00000001c0), 0x2, 0x40c01) syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0) pipe(&(0x7f00000000c0)) 4.720762439s ago: executing program 2 (id=3879): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x1, 0x0, 0x4002004c8, 0x1004, 0x45c5, 0xc595, 0x7, 0x2, 0xffffffffffffffff, 0x0, 0x80000004000000, 0xd], 0x80a0000, 0x2010d3}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r3, &(0x7f00000000c0)={0x20002000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newlink={0x68, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x0, 0x8100}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x34, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r4}, @IFLA_GRE_LOCAL={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x15}}, @IFLA_GRE_REMOTE={0x14, 0x7, @mcast2}]}}}]}, 0x68}}, 0x0) 4.643997208s ago: executing program 2 (id=3880): socket$tipc(0x1e, 0x2, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffe, 0x1, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000240)="a8", 0x0, 0x8, 0x0, 0x1, 0x0}) r0 = syz_io_uring_setup(0x111, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x4, 0x312}, &(0x7f00000029c0)=0x0, &(0x7f0000000300)=0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r4 = mmap$IORING_OFF_CQ_RING(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x8, 0x12, r0, 0x8000000) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x20, 0x0, @fd, 0x5, 0x0, 0xb, 0x7}) io_uring_enter(r0, 0x7277, 0x0, 0x40, 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) (async) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000400)={0x53, 0xfffffffffffffffe, 0x1, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000240)="a8", 0x0, 0x8, 0x0, 0x1, 0x0}) (async) syz_io_uring_setup(0x111, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x4, 0x312}, &(0x7f00000029c0), &(0x7f0000000300)) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) (async) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r3, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x8, 0x12, r0, 0x8000000) (async) syz_memcpy_off$IO_URING_METADATA_FLAGS(r4, 0x118, &(0x7f0000000040)=0x1, 0x0, 0x4) (async) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x20, 0x0, @fd, 0x5, 0x0, 0xb, 0x7}) (async) io_uring_enter(r0, 0x7277, 0x0, 0x40, 0x0, 0x0) (async) 4.596533625s ago: executing program 3 (id=3881): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfff9, 0x8}, 0x8) sendto$inet6(r0, &(0x7f0000000580)="81", 0x1, 0xc001, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x80) sendto$inet6(r2, &(0x7f0000000080)="b301", 0x2, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000007900), 0x847, 0x10162, 0x0) lstat64(&(0x7f0000000040)='./file0\x00', 0x0) socket(0x200000000000011, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000340)=[{0x20, 0xc, 0x77, 0xfffff010}, {0x28, 0x0, 0x0, 0xfffff034}, {0x6, 0x0, 0x0, 0x2}]}, 0x8) sendmmsg(r6, &(0x7f0000001c00), 0x400000000000159, 0x40840) connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @mcast1, 0x3}}}, 0x32) r8 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) r9 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x150, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}, {0x9}}, [@qdisc_kind_options=@q_red={{0x8}, {0x124, 0x2, [@TCA_RED_STAB={0x104, 0x2, "f01bbe0327cc4c7cbbb221a7180b8a1a1224c372b06873a6779e5d229187ed1816099aaf42dc5cfb685028fb133783fa45a91bae6c2b461a671dfb0181c9b33855c6c2e706765bc6c9986520c191dae72f744d86ca41d48997092ba23478567e52dfbabafcd0d82c21cdca422800db9bd9e4fdb70b1bc2e57538219f1790fbe3894b8ea44352e2e405f85f05c5f742a4890a489f3940ff31938fc3c659fc3dd32f4f11d2ca4032d8602173d6db33eea09fea5c345a03434474429549c49e140adb6ebc34dde37acd203541bb0107a206b843fbffd77972a3ef4867010bf3a6b6749e79ed02237fba39e2d4d4ef3adb2ed958d1126c0c20324992cac37ecdd623"}, @TCA_RED_MAX_P={0x8, 0x3, 0x7}, @TCA_RED_PARMS={0x14, 0x1, {0x1, 0x1, 0x371, 0xa, 0x1b, 0x91}}]}}]}, 0x150}, 0x1, 0x0, 0x0, 0x20000002}, 0x20004004) close(r8) r11 = syz_open_dev$dri(&(0x7f0000000000), 0x90, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r11, 0xc04064a0, &(0x7f0000000340)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r8, 0xc06864a1, &(0x7f0000000380)={0x0, 0x0, r12, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r8, 0xc06864ce, &(0x7f0000000600)={r13, 0x3, 0x1, 0x5, 0x3, [], [0x80000001], [0x20, 0x1001000, 0xfffffffb, 0xffffffff], [0x1, 0x401, 0x9, 0x2]}) 4.548368522s ago: executing program 4 (id=3882): syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x2, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000009c0), 0x42, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) socket$inet_udp(0x2, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) socket$nl_generic(0x10, 0x3, 0x10) socket(0x11, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r1, @ANYRES16=r0], 0x0) 4.451816712s ago: executing program 2 (id=3883): r0 = openat$vsock(0xffffff9c, &(0x7f0000000000), 0x600800, 0x0) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000040)=@sack_info={0x0, 0x4, 0x10}, 0xc) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e24, @rand_addr=0x64010101}, @in6={0xa, 0x4e23, 0x7, @private0, 0x553c}, @in={0x2, 0x4e20, @rand_addr=0x64010102}], 0x3c) r1 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x4, 0x101800) r2 = memfd_create(&(0x7f0000000100)='\x00', 0x1) sendto$inet6(r0, &(0x7f0000000140)="9aebb9b9a4f22d8c456179ed2a39c29d2974ed0c863ac1beb06585ab2b930683e9703f7358abbbd2b0fe33a6d5b11fd875c823fa68d8a51307abbd2da157596cdff6d02f04a07cdf7e409772622566b4aac633eea6c0842aa0a99787794618c1cb5426df2ca0cd2c222eba95ec767ac28dce1e41cee8110bbc3d5d492f9cfb", 0x7f, 0x4004800, &(0x7f00000001c0)={0xa, 0x4e21, 0x209, @private1, 0x1}, 0x1c) openat$misdntimer(0xffffff9c, &(0x7f0000000200), 0xc000, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000240)) io_uring_enter(r0, 0x3094, 0x2a54, 0x41, &(0x7f0000000280)={[0x4, 0x3]}, 0x8) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e20, 0xa3e7, @remote, 0x7}, 0x1c) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000580)={'syztnl0\x00', &(0x7f0000000500)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x4, 0x30, 0x4c, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, 0x21, 0x10, 0xa, 0x2}}) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x12, 0x32, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_fd={0x18, 0x4, 0x1, 0x0, r0}, @call={0x85, 0x0, 0x0, 0x8c}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xc}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @map_idx={0x18, 0x4, 0x5, 0x0, 0xe}, @jmp={0x5, 0x0, 0x7, 0x7, 0x8, 0x50, 0xfffffffffffffff0}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000004c0)='syzkaller\x00', 0x200, 0x0, 0x0, 0x41100, 0x2c, '\x00', r4, @cgroup_sock_addr=0x32, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f00000005c0)={0x2, 0x1, 0xfffffffd, 0x9}, 0x10, 0x0, r0, 0x5, &(0x7f0000000600)=[r0, r0, r0, r0, r0, r0, r0, r0], &(0x7f0000000640)=[{0x3, 0x1, 0xe, 0x6}, {0x3, 0x5, 0x0, 0x7}, {0x1, 0x1, 0x7}, {0x2, 0x5, 0x7, 0x7}, {0x1, 0x4, 0x8, 0xb}], 0x10, 0x7}, 0x94) eventfd(0xfffffff0) write$cgroup_subtree(r0, &(0x7f0000000780)={[{0x2d, 'freezer'}, {0x2b, 'rdma'}, {0x2b, 'hugetlb'}]}, 0x18) ioctl$BTRFS_IOC_QUOTA_RESCAN(r2, 0x4040942c, &(0x7f00000007c0)={0x0, 0x3, [0x9, 0x4, 0x9, 0x9, 0x103, 0x8]}) openat$ppp(0xffffff9c, &(0x7f0000000800), 0x2600, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000840), 0xae5f, 0x2) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r6, 0x80089419, &(0x7f0000000880)) ioctl$AUTOFS_IOC_FAIL(r2, 0x9361, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000900), r0) sendmsg$ETHTOOL_MSG_EEE_GET(r7, &(0x7f0000000ac0)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000940)={0x114, r8, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}]}, @HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gre0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x5}]}]}, 0x114}}, 0x48004) r9 = open(&(0x7f0000000b00)='./file0\x00', 0x8001, 0x0) setsockopt$RXRPC_SECURITY_KEY(r9, 0x110, 0x1, &(0x7f0000000b40)='dummy0\x00', 0x7) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000c80)={&(0x7f0000000b80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x54, 0x2, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x101}, @IPSET_ATTR_MARKMASK={0x8}, @IPSET_ATTR_BUCKETSIZE={0x5}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x1}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e20}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x3}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_DATA={0x4}]}, 0x54}, 0x1, 0x0, 0x0, 0x4002000}, 0x1) ioctl$AUTOFS_IOC_SETTIMEOUT(r5, 0x80049367, &(0x7f0000000cc0)=0x8000000000000001) ioctl$UI_SET_EVBIT(r9, 0x40045564, 0x1f) ioctl$int_in(r7, 0x5452, &(0x7f0000000d00)=0x1) close_range(r9, r3, 0x0) 4.261231194s ago: executing program 1 (id=3884): ioctl$VIDIOC_UNSUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565b, &(0x7f0000000140)={0x5, 0x5}) 4.189853947s ago: executing program 1 (id=3885): open$dir(&(0x7f0000000000)='./file0\x00', 0x10000, 0x48) r0 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0xc0505350, &(0x7f0000000140)={{0x0, 0x1}, {0xf}}) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$alg(0x26, 0x5, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a32000000001400"], 0xd0}}, 0x0) bind$alg(r3, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'blake2s-160-arm\x00'}, 0x58) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="280500003d0007010000000000000000027c0000040000000c"], 0x528}, 0x1, 0x0, 0x0, 0x4000}, 0xc000) sendto$inet6(r4, &(0x7f0000000100)="b8", 0xffe0, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback={0x30}, 0xffffffff}, 0x1c) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000022c0)={0x0, &(0x7f0000002280)}) r6 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000280)="3ced1fe02ebaacf3ec01f62e9b799d3d712f5dfe02ad344f335e46173514308557fceea23767d3918269393d91fc24403795e3224fced9d6beeeb5133f6393b84e82e453556ef14578660f97e4e9a475414b83d660fb0fc72c82711083d0f4420b825a256cab2de77e39cbab16555198b74f39907c3c7c863006ceba885e05d6e527220338dc0c31e7c1cb2ed82777c6af19f4786fb0bb12e450a92fd4048c1070f783a5ca3cf11dcbae5e9f0db28f6afe06a0bb2790961d57609d3b050f4bc2a13476"}, {&(0x7f0000000380)="feb88c9e4dbf621849f12de1886a08c1858ef3b7b72b48fcaa82bf7c259c0233e1"}, {&(0x7f0000000480)="ee053c7e0547cae686c3661ce8ccedfce05b322cc76e79e8b0f503cec39e032bd88eb4e34b434968e506bea00b47ba4131af29f9cc8b3c702b5f66d7a61b0fc939b595fdf669f622232e66706ebcae9b7fa05860b0deea443b25f0d4aad305a895beb7b8053e7dd7c20e17a52df5f49dc69f2c1b76bea02a03587edefffd31d04711217f9135cfb14238225ee1c7bb374e4227553c5651057ed94f88d2caf37bcf"}, {&(0x7f0000000680)="21d50e60c52f0ca2ba9a779339fe590d681d31253f190500000000000000f5955cfca1231def0e6f020000005e0ad5331e"}, {&(0x7f00000006c0)="f9e8a17e6f6563fbe51e79d142e0d65959a36fec1047c7b9eaf59fc1549f76e758dff8d764a00b4266b95220b994bd642ef698459853b35bfc591f8a6cd320213c97f48e5b27be85d17ce8e98dd4bf6654767b7607e5f7822b8a1b3bb251089d64b68882d81df27e140c5b4674a7f37c850dae5f10a0b09667846bc2329f7795aa98cf37bbe636c4a0a26c3c56e4bc46f20ddabb92290d111830129e7b422c9cb7f1c9c49819f7ebcc6218ca58e8edfe280505b22e325c77e87d265104e932bd537aa0f5ef6331f575e03e4c9673ec3527cda7295f90b9a88e0f4677ea"}], 0xc7}], 0x1, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="08010000090603000000000000000000030000095400e77f0c00078006001d40000900000c00078005000700020000000c0007800500070011000000100007800c001a006c6f776572646972100007800c001b40000000000000000a0c00078008000a4000010001100008800c00078005001500ff000000600008800c000780080009400000000c100007800c001b4000000000000001240c00078008000640000000060c000780050003000d0000001c0007801800168014000240fe8000000000000000000000000000bb0c00078008000b400000000708000940000000070900020073797a31000000000900020073797a3100000000050001000700"], 0x108}, 0x1, 0x0, 0x0, 0x4c000}, 0x80) unshare(0xc040400) r8 = getpgrp(0x0) kcmp(r8, r8, 0x4, 0xffffffffffffffff, 0xffffffffffffffff) r9 = socket$nl_audit(0x10, 0x3, 0x9) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r9, 0x10e, 0x2, 0x0, 0x0) 3.813416577s ago: executing program 0 (id=3886): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x1, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CT={0xc, 0xb, 0x0, 0x1, [@CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x3ff}]}, @NFQA_VLAN={0xc, 0x13, 0x0, 0x1, [@NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x8001}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4044004}, 0x4000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x16) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'lo\x00'}) r3 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$VT_ACTIVATE(r3, 0x4b4a, 0x10000000000004) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, 0x0, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x60d}) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000100), 0xc06620, 0x4) socket$key(0xf, 0x3, 0x2) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x20, r9, 0x200, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x4000004) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x20, 0x17, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x44000}, 0x8094) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000240)=@newlink={0x20, 0x10, 0x503, 0x70bd28}, 0x20}}, 0x0) 3.311856723s ago: executing program 2 (id=3887): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x1, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CT={0xc, 0xb, 0x0, 0x1, [@CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x3ff}]}, @NFQA_VLAN={0xc, 0x13, 0x0, 0x1, [@NFQA_VLAN_TCI={0x6, 0x2, 0x1, 0x0, 0x8001}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4044004}, 0x4000) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x16) r1 = socket(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'lo\x00'}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0xfffffffffffffe8c, r4, 0x1, 0x0, 0x80000004, {0x1b}}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x4000010) ioctl$VT_ACTIVATE(r2, 0x4b4a, 0x10000000000004) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000180)) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, 0x0, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x200021, 0x800000000004, @tid=r7}, &(0x7f0000000200)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x200000005c831, 0xffffffffffffffff, 0xac50c000) r8 = userfaultfd(0x801) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x60d}) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000100), 0xc06620, 0x4) socket$key(0xf, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) 2.750908733s ago: executing program 4 (id=3888): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000140)={'veth0_to_batadv\x00', &(0x7f0000000700)=@ethtool_rxnfc={0x2e, 0x9, 0x7fff, {0xe, @ah_ip4_spec={@rand_addr=0x64010102, @rand_addr=0x64010100, 0x8, 0x7f}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0x10, 0x8f75, [0x6, 0x4]}, @esp_ip6_spec={@dev={0xfe, 0x80, '\x00', 0x1c}, @empty, 0x2, 0x34}, {0x0, @remote, 0x8, 0xd, [0x7ff]}, 0xffffffff7fffffff, 0x5}}}) 2.665813957s ago: executing program 3 (id=3889): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42800) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000100)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x7, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffb}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}, {0x85, 0x0, 0x0, 0x5}}, {}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f00000002c0)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x4, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x20000023896) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) 2.50021168s ago: executing program 4 (id=3890): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f000000ddc0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) mkdir(&(0x7f0000000180)='./file0/../file0/file0\x00', 0x0) (fail_nth: 2) write$FUSE_INIT(r0, &(0x7f0000004200)={0x50, 0x0, r1, {0x7, 0x24, 0x0, 0x41046100, 0xffff, 0x0, 0xf7, 0x0, 0x0, 0x0, 0x1}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="1827dacb7cd53e01b4852de2d748e21fa033071acb841f449efc23d452101807ae5c485596338a6d31388444ae8ade7b60a85a37d3db29ef19ae4c4d4db9c2c82c7908debb2e2b5ebef336aad77bef942d064955079af4e914f372cec8ed0440f6ee0bded3c565283bdb75124011227712d5f01e8c1eb86cf69205a8b5b374edee58ebaf09d62191cf41190260c30a719bbc9bc29be0d60c678791de6b236c9b5a057247c281937c2b2ae747c858532113e0a1e7af49298ef54f15572301d3c907b02529bc470beab8f9208cf92b17a9df99ceff90a1e384d6bda3fe823d8eff0e2229a43c31781935de69466b1082c0f88d3716f234e1d6e17e1360f6621e686d661af20eaf08cc97c261590ac3291667a87bbf66f86d9005f034ea5517b2187b6dfecebc1cb8fc4dab511a2890a68ed185483c548168803f353520cc6f820d1349ac985e12a3ff6e8a78b29ed97213962fca3ba7d04d1ab4dbcfe93a88831f784ed278d079eb3e2e69d3161600fc7b0dae825b510a59c14315fc6ca0ce68dafd088f02a92ae0ab3f15ca1a863b640e8e4a89407a8b8d752892e1f8b0e793d430c3ec46cbe2b6a4bdad728c34e734864aeac2b6b2eb51c3a2f9e6773c5834166511086dc35847cfa17974889795ed305353d41c9399bb95936a3c1be1099f21795cfc04d9699929eca65a0edcae5d4e564404e5292dc15f40d78d94be9e8dca92983bc71729ab30a70455bbfd5a98d97cab9778d9b7b69fb20019e7e7c7bc17c84da1dab53a187a116ac229e00312c95b1074afff18a8771a4ab47be2205745836dc3cc1ce531fe697e9a734698fb2343b331ad9f13214d1d7d511dc646fb8b3b70fb4611e6d102a0e2bda6311ca824537f699efdefbd8a3a523e26272f07abd75504188edc788af9c75aabf77f4ac883573f63ded319fa5a8b6317d4490391879629446fa5ea4c695f3db9739f7bc1da7a19f3e1c0ccca98307b3a7a38272b7455c8957b17138c9e170c27895fcf47eb5530948b7cc43d61a621293b0c83dc893f02def2b42a8bd7ad6c9cdfeb7a3bde141e98e5af7500b07d85c6314949b754c88cc666bdaaec89271f56ec11bfa0aa337feb1140b8a07fbd5c79bdd0239f8aa1d454c0e5a16e99d38d1212ff709bb1964c317c98bfef37b56944666f0320ec85b5b1e07731de5584901f8c65e14fd2ba83b500fdbb137c7cdf91d66400688a5da6405ca7e0b8107ed65be0ef5c6234b62f613e7e76d6f3d5cc12bde4342391524e25bab6ec0a358c6c66b7cdbdd9301f91589af65cb7c02fe8271a798c5e122fef9e7581d28884d33d01f0475c9ac052d2d014bdc09e2738487742f7bff40facf2e96dcdfefa336c46923b77b334daf7b01a9fd5d957a29b83adf6f23acc507a58dabe6b2804532bc1a865a01b1126127f7c6a8029531db8a51d8472c0abffca5be97b9b5433ad220ab9ad65cf94a1167f3fb2b8804ce66f9f5cae212724b2b3a04343580f5919f446f40eaa0177f25ebe68ee7c7a35d9d5ef6e1cb220eaf8ad9b269b15c2ab9692c345f3c3bd5965f06adfdfa2d672b5e3184ebe192f73e70e829adfac2e6318d238dceb6e3d7d1422d57ff7124793b92966bd229c0725b0d591e59c57f98841b5ffad16d0ae903406014d3e632d0654e9084f870e124046f3ebae3ecbf5c5365aa32ebf169ccf1243dc8fb296cef006d5f00447ecd2980abb98e3b6e6bf6181e5df7994ea1c1273784af0d92a57394c71926dc143228a8ade103ff61860d21ffd467b2c41bbbd2490dd36add865828fb64396f16831a3a74f57ee2254cc93b25b7219bc00339a2518be3caa4765ed63295c84f1d59144e96aacfb57c6441f64f29729bb7d68127ae2472bbf089570003b1e820191878ab6f53db01c180751e34672cf5a96edfefe164580d6101672281b59f58f3c7b1222f2b6d19c8a8e5f9ad539045f7dbadaa767f993da974dae20744bf5ad0e0ec71ee97696659981e067463c78bd9337b8bcfc070e7e5b47303eaaf9651c19f19a15eab8e2c47041828be50994b5695ee5fbc9a9ecacf9de714215eb7992c07f262db8843937934fdf6fdd31d0f3a44f074f3a1dd6622dbdb3364df79d5ec90ead64c29e05a6c5358cc6b9d8493b7e1c53a91c37aa3653cf2002072461f4b99fcdec142e53b87f61ea55cdb834dd4e03f2f57a206cabe2f3f3cbfad3b4117bf4434718022b09a8419959a9bb97fba50a6b3b9a844cd1301de7bae89f8d1bf549b88dd2bd0697e70ce89cc2e383221ca2ae9d3671a730466c250a8963f6411a42ecc85a00c01b2b43c39432d5065a5fd11c29a23169891cd674cf3a31e82587a26c8d48aa3debeaf067a26669599fae850126dd516512e0cf5ab556b5582add7d2f665723a2244007ddc302f0ec29da73578a80c998849be2f766a334c7ade4dd46f37d648899da5cf7437af2d6e8d03d934903387c4c7e260909d59b546dfac9ffdce11fb92e5bb6ff6836fa0e6d0c5942b4660fdd68d3cc8a76ce0960584dbf634695ca75752b19067ba535e4779189b111c9a3e0ea877067c046d10021b0e60eae8d5dd7536b4474d8ab74679e2d8e68bc9208db5561e28d0bec177cda1e2f944a4cd97b6432033ce40063cbced6b36e486b096adffd699c9fdf58d5ec54bf4afdf52493fbfcd91e807da31ff675b567058697aa088118a6ecf1b7c7dceba3ba87d59d882fce3b3b676763ed658e991c4fd5746946815af0a2c1e96aeb27383cf6638d6d7e1932b3a028250fee18db7c46acd7fab33ab22ff91cf78029a4ed96494151652213fb7dcca0a8944568bf84aded113e20e6897d6b8f6f9fe5f6975c7cbf999d15ce5f8d50454d58e7a5b285fce4ef9d14758cf4a9619b17275fa66f2c6c48d44da95657708062bec9b633ba2df082766f549c5c1b661fc8a5f7b8b6699503da733a66df44f116c4a470b73648cb64bf04101e7bc1d048d230addbf22a5b98aea08beda847e33552faf771d9b181f610ce34530543096257856ea3a08276bec1ea40e7bf6957143623ef47b5c41e61d076eef0a5195431b49beab9fd7f07b1a153491a7250a889b26ce657df550b226fb94cb5f52306f47ee3af4627ef0cdc0c50536af7b386440b878ed5d672670abdb3ea3e3c3c031e67293104a4d6476cf325f6fe4762ce2351dffac116387baadb82f987cab7fe88ce1be7d44ccd572bfd29114d2ce4d5e90f4d6bf7be39ce25ab7de52815e4059d783564d518dd208714de1c524ff69a4ec5f29bb631eff605cc6f30a0bcfba44810a3a6fc263891791b51cb4be0d60d3d0798e38b01b9a21150589a436fb4df4584bf6e7094176884921bbb0f87b1bcdfb6df8aef8f58393800816c15647650448da0ba5bb76f7bf76c3be83aceab79eedae80e1fb46a2557a9485aa7a8053a5835e609fdf54222f5b43cba63c9508dbbd0e22953768f88e2070236d7255f682464d09c7ba12b2e8787a1bc889af686d2c355961d8f92f877bb09baef09d70b5b306047d8d3cb97fb06ba8d09bfbae02314dddf98092b6ef275743e9deb391995003d83b549ecd604daa9bd34ef311aeced5db504242241c0717f8302efedcd3fd43686a7ee21c73ba3c5af98c93d09158c9011e11bc4b51a3a4e904c4b6ced1a786adf310073405c27df6aae6d5da4398d78622ba9144ad09902da49b77046ad22fd303f07c1533f271eb82794b402382d2971f46c7907069907a7afb9e94dd4071685f91cfca10d86aad7c385e4d90f0d44d37588a8f1f267c1d8445634ca4194d1a0c5894a6d00cae3af3aec991cfefda59e3f46c0a6e2fac55b35259a9960ec7dbd1c7dd128368393f0de1e0994ba1f5b41762c22213f56bbf4c2cca458dd5731f9379f0651ba61fbf17a5861eb417e20a7fc9df12c6771f5ab322213ec95beff96dc1811dd0f45be8fb1ed93c2cc01e694620b550e45bd265fb357f52699cf9ca3ddf331fe4d11c5e97bb57631d9c7620b5c19562c85ef8e04ecd5cd5b713fbd94b6b76331a83f304cd8ae1a903ffa722cf5697b1e1bde206735656ce57254744daff8013f47f9aa4f062d8c5956fa8df5ee79d6e6ffbc0c47cd0c99517a6d92fe8ad18c001be4b55af7a6533712c6a2ccb7e813016e7cb74a94bf2a2ce9b3b440faae19210d43320cb81a6472d1da775ca27f2b5bbe5964271eefccdfa0bd6b163357af4539fdb5d5e2e7e1795040776d4d75b70928b8efa954556f4d225bd9b6f9e5a71a8e7a3ef5c36d459233c66650ada1c55dfa02bca3997f93b92028881d9c3ec0e7e1a42c587482b0cfbc77e8520c6ca0f3e5127c96b41056b7279d9e62358e39dc95e779affaaaddc8e9ee66ba336feca8b957ccb4f352c0d162390e3bde27b15132407c97c3a6b5f1704e1e559ee12655a71d7dce3711c8af907d7d2875e2407ff8c59c5457678058d3d00a7971d239c1b1c67dac3ff3fbcc2d8c8035e31040118ac46ba5110a16aedd0b7f731a4f86a63a697501a664946eaf7da6d3cc2a296f294ee765b8f26363ba6116e0ea0ef8eabb0f1e7cc429611194cf0bb66463d26a82dd118cbbd3f1040dca2f5f82ac5eb5df41a4658fcb34b68066c5708a4a16c48fd290b32e392e7f5b662f4e3fa2d79a814f52824cf737872604672bdaf80fc527deb1f690339c92b6c6c6c8635de5a2e1a7ff617d0f1c11bc3a3504d0de94d77678025ab5bea511d783df148e58b0793251db3b7b9e03bb201be89d5939c0a60ab548460d543d015082e00ad9d05418c327ebafbad7924aaf70e5fa6eb0be359b65ac2fbbcad495b17712e033cbf1853d1e2450ac4c8d19287074e76ca3d087d376b0f861b525d4949098dd4e3a3cc50118c8587adf6587ed9aa0352b7d812fe66bb64eb0c0f4d46822aa9c3d4848454d49b61cca24d7d6b82fafc5d8eb4e40e3665f24a95182b70b22c5f9303a49d1278f25de9855246c729fc8ba300fad799a949b9b0ce303477d22337d599d4c8441461d25725965183210a729fc59c4e5ddb45c0b9db06a09619e6009aa0653cd1e8b06d0e55c133d5022dcf91f12a21e9f977de2485f886c5133a8837987e7bc90662156b0250cc76cb03ad9fa36733ef371479ea9c1313682866b963f1f96bba8c658e2c6a10e5e29d8a07d4999b735bdef7f60326aa64fc198c3f2670fa4a44717fc613f1282fc324fd9476e6da7866cb6ce1efa8a1577088f2aa757584b8ade9f2ba34a2287870da2cc7704008b6e057eaf8bfe2fd0d6d60cf03e1751d2284c6439ee6079708451e64b1f7e7dc8400ae99e0d834a7daba6c3a8219812adff0760129e18a41eb0448c57a909714cd395933436e9ae040277f213e30ab7b6e7e3109642ffa051b3c423f6ffa7830c75d229acd617d6bc1f7948f09238f5437ff4fb302034fec1fed96c55c46c7d70d6ab3018c1a3d76120077f815fa67ec8815f44fd0cae7d1509d217a432ce904c778f201a508fdea4672e9cff797bd1d0f58d46f39396e148573ae9b2468e4ee5bd9a5abce8166333c524f0a104da2e3c99ddbc51fc6f4e7c628af79c93d0fbe61b1c4a72b11fe423597f126467a01ee6dad848f24abdfe453592f02c84e017fe553f27e639f88824d70aeeaca54758184f95f12d696291798046bb075fefd6876e8ef893f5b9340e21fc63c67feb6f03055f2f394a591164a61b1aab14c468998175b75974543e79b241dc69a6e346374dec5eebae154e36f29d17273e608ce69d539a5e4702f474bad66fbf3348f0c859bf884576faeeac754e290ec97e863526e55420da72b6b6cd209e6685ffb64e9865d00eb017c843d3c0cf3ab26f53f76316fbe009f0b2c4932b0694fecf1a148dbead458ca9f5f6d678d6c6fbd23fb6aea9e951914300eaaaf69bf35d4ce11c0349a02aa14529a083e701eac0177d4ddb305a9f9a5cf8bacd96327a161bb8b877813ea022d62bac8f0ab9eb5e9d145dda4b1fe79c0bee34c8bbfe866ba376d3a71b9809adda06e64eafaa6cf53fff8ed63e15525fd409e13b1809ae6e6e937acf858a59d2073b304171d5ab35ec92f66fbb2d4e34d46e886c3546c1026d0ff27821a15aa397dbc686540d546ea66fb43dcb9beaeadde6250cfe8e563f9033b432018c88bec07279c6a0228f3eb11031d3435d95c9c1789a5338f74aa6db2c853c87f8f2397f9067fa59774770f64b8ae42b9a07f85f1bcabbc6d3b3456a253bdb73ad3de0aa416589b722053c81db90e7b66a835d636615701e6869fef016bfaba9da0a869005ffc3174b605fdabdb8c7346262ce78a64aa7036960913edfffad202d664d1771018de43b6548a6672f48979b8e30017a93da2c093266306e09eb203fb37d7d54466fb26d4414ba88346d02d8811f100dcb0a3e50ae46247b986b928f12c1ad506c6b33b49d7e6955ae9619f73c79b72a95b053d53c4c54d36dceb8ae780b321aa41b5d61caa21a6c65329f08da522bbbb3d07501b39cc6bfbe4a2ef8054d7c57666bc805ed451517a1432b958141f3ce94752a67a17aadb41590037da8efdb251eb56de30b0e0e75adfbf4e06d4777f843a8d7c31e2ab62d98764217491d46960d67d3ee1213d150c28e75d1f440d41ffc3cf876554e2d4a354f70fce17e4c0fdc64992c32e785263ca4ffcab57d3d46d220627ed05f1628551e9843137996bc7a0b773e1ccfe5364216a8003757ffdc052d93793a3463baf4eef5dd283826f8510bb1f20505a6e61cb3d571d0f77e67ff3c0aa5ca91f6d68c7e0d2d79c649b091b30b2911c5c47157c9c531296eba681e039eaecab83722cc2fd5b91913a463ba9f693e34da60b1adb8ee9f4a83fa67e25f19e4cd6e19ed1381cba8b5b4591109637ae1f7f29b5495fc5f8057da565d937e7577735bd98fe626ce8568897d240f054ad69c8e0ca424d1be51b17d5e639253fb2fe6791e01edcf9c4f8404233d7f98b52c31c4996b6b63112d0126036ca20cf52a2da2478683c41bfd8fb5b34de59d5e87b5075e5e1d78ad06c6a2f6e662145be3d30d140b62c49df203350ea4412c97aaeec7aaa00d81b89f3b7295607840de2a8386f52012b5c4e6e0e1986565bc4f99b6bc10f3a2ab59783a8b9f3c696f741af0f51b6592c68ddff861fc7d2b16876b05a54eae9ec0e170fbf26d9358941c6cba50a5c41e77f72c7f41e0bbf6023f04f7701f676a64cb63ea1a8d373ee6a99ba56449699ccdf8a11dc7d840d695cd5ef987f74e5b16594cc8c6c2251c47b429281b6e34c0288c7242052ac3c9c63213f6ddb08726001e0afe1fb312d463db8722f1617972dc7f365de498027ef0b5c6d100e583348cd777a2afbfd60ef59969c8f88358b6995c177a7d7e69d86b11e36f42bae8c9af599d3f828447c31004000163bb74ef20f656f6a1c8159bd0f867f2e283c10656a40a397b2e514c19efb5d5a5f54316509801bd8208a2c84b2ef13e54d7b8af8787b826b50095a15e33a5e8e306454312a83af7869b7ba0039ca601751b580a9190435d35a8ce9d8e9558ca1bcea3cc3604f4e991aee79fd0d2393b9f87e8dac7782e837e1de5e88a7c79385a2b14556041f49c1113df43efd8aea14c4b651d713fc9989b2fd77ce13a98efef5e83cc6843d313117753d82870c5efec8cc6fd855ab6e0fc6d48c66874fdcb2d007db7fbb9371da3836eb23da1106283a20e32617bcaba574b7b6298d48334eaeef905ff348c2bfbc1c83a88d6915b644d1854161ab4f1d1db12e74de2853e48d1a10f9835c226bca6944d0de6a18e0e07df45ad72a7d354045a6997ffdee010e37091a3a5280e5db8aeea0245217a6f1160a6287d9a28c0eeabaebe755b9485da5b7ccb85166ed902e63200e5e8ac464124bef0196eddee6cfe90fce770b416817e1ca78494786bdaeafa3538841f74bbdb2585d63f667ef227287efa56c030c0999e9ead590f1ce383a138233235494ecec0aed97c803b4d7c4fb80ac9a3bcb1dd2bab51382a94195bee034c3f3d3d9efc44add83ec580a5cfe8f5942b1694b0ab3ef4b2d9f7c0b8634b056c6b6eeb946be1825fa452abdbc1545cd94774abed3fdc2b0399929298221030f6cd0a2b38490f5e4bfd53ee20de10eeb2ffacca980d40e0885cb91c94a4d81a61d863efd0f7a12da233e1dacf7af728950892ef887abcc5e4d08c6b57834a1e5dd1dfc69418fc681b47d8cd34c6a3846b0e1afdc7c7f9033ff817a72ac617c0a1e59e4e6ea40bd668c499f221c5f63700e74b68ba3045b4460f0fa60308cf8964d95237d888d5c1b1be0fa7bd2703eaeb0d2914b8d22cbd8693c16f21bb72566f38aa97e86f212557d40e10b285e1d4de0b153c8f91e168e9d0031bb7ee7fec5f0c3fbf15bc6fbceeae6dd363b7e9835b175b0be16a3348a2c2d07468449fbb2fcfca9e7d8b72b623355715a6a1edc87ea4c699ffeacb2277fbb5658a1eb12d0a7a93bf100ab11cf49b35c16a14044ac8e5bd69af05b252325f0eca41f90681b4a1ec399096939a96685926655a0c4d172d06646c87f35b65c0d7654882b79838f78c35febbdb378f9f28d7e6ba1c1fa191bbcdbf991731f546439a966e4f7a15c77367161bde14b731c9f2b91114fa46e02e70f07d3c40988e8140866ed3dcd98ef5524700deb75c1a6414016da0ce6845e936a8692b7beac01bc855a72a490c667c3b755ffaaa57af54af1bd07ae7b203be85f3653aa63cc5ae10f6e585c7bd8a5257604e82fad6c7be6f1a47eb665c1422c03d3263f351671a48bd5eed22077b8c16e706f009880941c29b90c29a11ef008a371b29200f32523b9847d911fab4ee1468bf98a49ff73703e2d9d7bbf6ae37459c3cb502541f304e1d5918518a06225b65f3b38b91f8e0b49a29ef9aacca369ce5cf8b45738e29118ab06078b885189acf4d0a5200b86cb2269dde90dfada27975dbe6ded12232c0faf7ea12ecacbdf416cff8632e48346478a75c0279c1920b7556fc6670704d5d97912c75d3a9cffe6891abdf747a6850ba7d9668e56c7e7ecc03c5c388e886bc984c8bfd9f470b7e4ea4d146c3c28e4f8ff82b9558266343036e6239a26f567f7633911ccc51522c29ff3ca36ad5b8cfd6ec1c86ae08f30d87a503c909e66dc278e9d14f3fae4bfa4813f315b1610ed76fc149d92f319044e813c3769d4978637e0ee732d3bb86e9fa584181f41d4304c07a1cb71d10f07da649288275a213eff161c536c7366d4c010cf9a4b1c2f2940607dc7468e51204c6983c554d616d48f93ae51e6a7769b3285785ae7bcba3cfb27879df1d7f1f18849a70814eb51df6d1d8cbe80b736cb38326f7db7a06e49cd4fe41b3f7a9156cfac9222ac23d13765e7f2910a365fb23a208f192cfca97b2b8a3de44a2d90d3c865bec109f4bdfb1d37216cf5f71a27c39a83b5562b0c06d76b46b2d8f5b15cb1765d6c78d065d24bedf72405dcb8e795fe183196a6b620f918a2dd7fdfac142aa653fd431ec153e3daac8f615a45b3a0d665d5fe36efb6e2f18b8399429e4f363748eddd5cd2a637e9a0a553fac6d05a3e2bd1b26f2f99433f8f59a3691417a4f35ff7d46a22e39e94641d942706850cb2843ff4a34122e37dcc8224ae9f6ab7f64ff4a0bcb0aaff2f429e4f0f5fcf90ab6a2c45e8f2408d9bbd4f60d6b01a0cf527895e1cd063b178b8973930b9488d81d3f0f7985b900d0a894c29642b809ef39294bfaaa5401f5ed50cbb91a047b60ad54b323a2f2ada04d19d6dbda02e0f22d4d6520f9db2263181c97c9bb74dd8a90adedc80bfd064eb103f67d02ea17571f870c779470bb6460c658da4c502b9a10c8050fc26ad5cc1ae1eb02f0d703d05b48f48ab8c9f9a1bd000181ccf929d45544b44e9a3cd0bcd412ad639323283ed229e5486a2a93babb165880a0a7329834bb51a0631cba5caa30637ca3f07074051c608b7c7170c8c415c2eb88bd6a798bd86953ff71052506ccf0e2357deff6cef24de5b7f68a17082c08d096e43fbe727ab0ab1aa27a703ccd58168039e50dce2d400ed7f2a217c1eea7b29455fbf910d36db324d1c6b53343a78484883ad100a0b5b28c74ab6296df5bf8048fb916e8ddda0ded3f5b08d262b9b1cb1ecb149c02a21490ebebe8856c844d448d2a3878dcc930c3c88d9addf73917e9d3f878fb12fba3e602cfde199a0e69eab56e3d4ffa01135b3145baa613be01f0b94af5bd3b8b432339c954f52b8551fd13790bc1ee18be226b819d8001a3da8e097f84c166e4002e4c1043d3a3721f05105cd17a278b9509d7a04826e8a5b4956bbf976ffb4857fd88da99cfea8d2e0a1c4f52f71f87cbee8c02fbf59b12bdaccb67d0b95f0a56693eafafeefce1953d708b56532ed5bbe12626a3d041c031b48a47b34c504f7dd57e21147b920c058385ddc8cbea5332086c269b0d5c2439f30fa431f88d1a10e25eba0df70d8617ecd5546314ffeae9c4baab872ab82a45eeaf0e1e1533e8a6189c324f31b652aeadc52981b66161313999c5a7bd7c79ef4ee55c7cb00ebd9637ffe01924508a44ab72ab16b70b8b815ce7d27772db315122f4a5a7679af5ac685c26320a71cdd8066b19f749705e2e35d1d9166ecb066053dd05a759270e119944cf99b918cb5e4e6c931031ae2eeffe349ac246c92174091c687c58879e1f05c43b010f7ec3f204c106cf60740b0bc2d355f57bbaec7d060dedab9aebaa4094e72ebffbf61cdfb7d69fbd146daea59339fa83c19c5f75b866af5e7f387740e675e1e2ba29c261d9e7237c6e9ef1b39a8fdacb44de0eaff5f4f9e3e42b75d0a37834eab0cf47acf65e882f0962e01982e783c0dae7efbc95dccb235562e5a2e04fd2b4b43388c0292e6e8198c6df0348920d6e1c8acdd2e892d3f7aef7703824dbb08695642f0e444ade6c4f1ec1e267feb5135cccd50fcde643acb66dbd18f507496957ced435e0db0a8e8441a8e2ebc365f995c32399f7d180b6faeb85ee1921b95f82f3194bed7d157e842257d2da26dfac90f32fb53147e48e232d5115f1cd12b45c55330b29775ab776599afa504b7fe114cd7fb3ab4eb6c30becb82f448b284b20010bea918019af99b2a9ccab1585aec19fd1abe8365a6023f96dddf1a37cce2734bb6585143729850bcd811787bd07cb5fdd57cc987f9278b7f5ef3c7529a9b6d20d18cc4446f1036cf7635da6732986c38df4785e2e428f14b84957319772bdbb7d2d2d20321e522b1ec6c807f3a3f575643d4b71e1bbd1e843b5816aa68900298f5058c65a9fe1022978a44a77bde2b99e221de97cd7fa6a2ea440220bac20e3e4c1e4224958aca15681d3a18f74218114c3e5eefa1fc16de8c07f1d1297b0e772d05f205337175c1dbe88dfc876dcfce367304afac68c41b98ed2ba3f04fd1b37db27dd5d9c9aafaeadfcc44585908ea655ffce1fc2516b060256777e8953e2a6861ec4460034691aed001ea2971627615fc7972773d6a8c343117bae3fc68cfd1f187c478c0f52e86b118c65c39848a8c582ed908fb1242ad3455288cc858e52e119d368e00783c2b8c2916ba564a3501326baefe1dcadac8b4b8b666f20a3a245ca171b43af", 0x2000, &(0x7f0000006d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x1, {0x1, 0x1, 0x20000000, 0x8000000000001, 0xfffffffd, 0x0, {0x6, 0xfffffffffffffffc, 0x7, 0x7, 0x8, 0x0, 0x0, 0x0, 0x5, 0x8000, 0x0, r2, 0x0, 0x403}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.168712909s ago: executing program 1 (id=3891): syz_open_dev$radio(&(0x7f0000002b40), 0x3, 0x2) r0 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101002) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x80) pwrite64(r2, &(0x7f00000022c0)="8d10", 0x2, 0xe6c7) lseek(r2, 0x9, 0x4) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'veth0_vlan\x00', 0x0}) r6 = gettid() sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="2800000010000100"/20, @ANYRES32=r5, @ANYBLOB="6d3082610000000008001300", @ANYRES32=r6], 0x28}}, 0x0) madvise(&(0x7f0000004000/0xb000)=nil, 0xb000, 0xd) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="740000001000ffff25bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="17200000212000004c0012800c0001006d6163766c616e003c00028008000300030000000800010010000000280005800a"], 0x74}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) sendmsg$TCPDIAG_GETSOCK(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x26004411}, 0x800) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={r6, r2, 0x0, 0x2c, &(0x7f0000000000)='/proc/sys/\x00et/\x00\x00v4\x00\x00s/\x92ync_\x00le\xf44\x8cm\xa0\x8dN\xd4\xa2\x88\x00\xd1l,'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x31, 0xffffffffffffffff, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='fd/3\x00') getdents64(r8, &(0x7f0000002f40)=""/4098, 0x1002) ioctl$VIDIOC_QBUF(r0, 0xc04c560f, &(0x7f0000000100)=@fd={0x80, 0x7, 0x4, 0x400, 0x5, {0x77359400}, {0x4, 0x8, 0x37, 0x6, 0xfd, 0x4}, 0x5, 0x4, {}, 0x7, 0x0, r1}) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r9, 0x0, 0x0) syz_usb_control_io$hid(r9, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00120f000000540b4550182194f575a6b39e3ce079"], 0x0}, 0x0) r10 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_V2(r10, 0x4004480f, &(0x7f0000000580)={0x18, 0x3, {0xb1f, @struct={0x7ff, 0x100}, 0x0, 0x3, 0x8, 0x8, 0x8, 0x84, 0x452, @usage, 0x6, 0x3, [0x400, 0xfffffffffffffff6, 0x7, 0x2, 0x8, 0x9]}, {0x5, @usage=0xad0a, 0x0, 0x2, 0x1, 0x100000000, 0x2, 0x8f, 0x43, @struct={0x3, 0x2}, 0x5, 0xba33, [0x5, 0xf000000000000000, 0x9, 0x401, 0x8, 0xb34]}, {0x8, @struct={0xd9d2, 0x7ff}, 0x0, 0x9, 0x1, 0xe1f, 0x8000, 0x9, 0x404, @usage=0x9, 0x3, 0x33, [0x100000000, 0x114, 0x9, 0x174e, 0x6f9add4, 0x50f800000000000]}, {0x2ee, 0x5, 0x9}}) 2.154417464s ago: executing program 4 (id=3892): r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @dev={0xfe, 0x80, '\x00', 0x36}, 0x7}, 0x1c) socket$kcm(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) close(0xffffffffffffffff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000940)) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x2, @in=@broadcast, 0x6, 0x4, 0x3}]}]}, 0xfc}}, 0x0) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x20, 0x4001c11) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x8) writev(0xffffffffffffffff, 0x0, 0x0) fchdir(0xffffffffffffffff) syz_open_dev$midi(&(0x7f00000001c0), 0x2, 0x40c01) syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0) pipe(&(0x7f00000000c0)) 1.972193618s ago: executing program 2 (id=3893): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x2000000000000) socket$inet6(0xa, 0x800000000000002, 0x0) r1 = io_uring_setup(0x410d, &(0x7f0000000000)={0x0, 0x60a4, 0x0, 0xfffffffc}) io_uring_register$IORING_REGISTER_BUFFERS2(r1, 0xf, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c1200003f000701feffffff00000000017c0000040042800c00018006000600800a0000451202803f12148004", @ANYRES8=r2, @ANYRES8=r2], 0x126c}, 0x1, 0x0, 0x0, 0x4048051}, 0x40480c0) 1.949321385s ago: executing program 0 (id=3894): r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000002440)={&(0x7f0000000000)=@in={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10, &(0x7f00000023c0)=[{&(0x7f0000000040)="08ccb232", 0x4}], 0x1, 0x0, 0x0, 0x24040000}, 0xc0) sendmsg$inet_sctp(r0, &(0x7f00000009c0)={&(0x7f00000004c0)=@in={0x2, 0x4e21, @rand_addr=0x64010100}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000740)="3d9e", 0x2}], 0x1, 0x0, 0x0, 0x4000000}, 0x4000050) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000004dc0)=0x2, 0x4) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) 1.743766938s ago: executing program 2 (id=3895): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_wakeup_irq', 0x0, 0xb) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000018c0)=[{{&(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000040)=""/26, 0x1a}, {&(0x7f00000005c0)=""/198, 0xc6}, {&(0x7f0000000240)=""/77, 0x4d}, {&(0x7f00000006c0)=""/4096, 0x1000}, {&(0x7f00000016c0)=""/231, 0xe7}, {&(0x7f0000000100)=""/43, 0x2b}, {&(0x7f00000002c0)=""/49, 0x31}, {&(0x7f0000000500)=""/126, 0x7e}], 0x8, &(0x7f00000017c0)=""/240, 0xf0}, 0x5}], 0x1, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x3, 0x8d) setsockopt$inet_msfilter(r2, 0x0, 0x8, &(0x7f0000000340)=ANY=[@ANYRES32], 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000000c0)={0x0, @local, @local}, &(0x7f0000000140)=0xc) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000000)={@ipv4={'\x00', '\xff\xff', @broadcast}, 0x2, r3}) r5 = socket(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4c, &(0x7f0000000000)=0x3, 0x4) ioctl(r5, 0x8916, &(0x7f0000000000)) ioctl(r5, 0x8936, &(0x7f0000000380)="fabb1e5d54ea3839d70911fc0209ee2bb310ce83271e95efb0e225b79f49544cdd04582844547a7a391c3e94b3422cf980a20a7c42be591af8e64922e6061c207c7c8e98dde4306243036b5d0f34bf2ba36026eaa11fec13c9881fe09fe0d6eedd57e2b2ff3f562bc9f42a01d65f80a94ad30a316ffd6bf82ef526610d581850a9b5c1a1dbdac7bb89c3001e38595c05d2f5f74dfcfb3df1a9b57a060665037f625e5c0bd895cd3bcca792b83382cbe3a98013a893c50e74d5eceb5266c7f1c20e6eb1090a7b2335") keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000000200), &(0x7f0000000300)=ANY=[@ANYBLOB="656e633d6f61657020686173683d74670000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b79f83200000000000000"], 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r6, &(0x7f00000000c0)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r6, &(0x7f0000000580)="17", 0xfdef, 0x10008095, 0x0, 0x0) syz_usb_connect(0x1, 0x36, &(0x7f0000001900)=ANY=[@ANYBLOB="12010102e4e70608b1134200741d0102030109022400010102904e0904b50102a4b2eb0909050e004000090281090507100800c00908af443e4c0c785f5e3d59f22661d284faab2b88054023d802f5151371f5cca7dc466cce5caa048d4d721c8a97d777f78e92584e5f653f1c0f09a1094fa5f965a795c8239b67e4ec2eac163c8777c9b222efdc5b7ea0286338b000e21847cd5be39009137b3bcaced200600158f48cdf7ae0b00c69e609ef214e90952c17232ed9bf6fc7f9100aa68791cc615fc4bc2fd6b12fbccbdb0000010036ccc5401595c36611f613a6136eb883d36dbb77ebfda1050c536398dc2acc60c75d6a176655dc1e5eb7f9a1a3b4d66137b2"], &(0x7f00000023c0)={0x0, 0x0, 0x0, 0x0, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) 1.399211384s ago: executing program 3 (id=3896): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000008711e0e17000000000001090291bfe8610f0ab3f80400000203000000092104000001220500090581030000000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x4e, &(0x7f0000000240)=ANY=[@ANYRES8=r1], 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = socket(0x22, 0x2, 0x3) getsockopt$packet_buf(r4, 0x107, 0x1, 0x0, 0x0) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0xffffffffffffff7a, r5, 0x2, 0x0, 0x0, {0x54}}, 0x14}, 0x1, 0x0, 0x0, 0x8001}, 0x1) connect$pppoe(r4, &(0x7f0000000180)={0x18, 0x0, {0x1, @local, 'veth0_to_batadv\x00'}}, 0x1e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1b, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0xc, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14}, 0x94) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000100)={0x1b, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) r8 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x141100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r8, 0xc0285700, &(0x7f0000000140)={0x1000, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r7, 0xc0303e03, &(0x7f00000000c0)={"3c24139ed44aec57f2e2ad238a7b448ed886923c31d4b8affbf514fd00", r9, 0xffffffffffffffff}) ppoll(&(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) close_range(r3, r10, 0x0) r11 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r11, &(0x7f0000001240)=""/102400, 0x200000, 0x0) mmap(&(0x7f00003c9000/0x3000)=nil, 0x3000, 0xb, 0x31, 0xffffffffffffffff, 0x0) 1.168923356s ago: executing program 4 (id=3897): mknodat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x1000, 0xffffff81) creat(&(0x7f0000000380)='./file0\x00', 0x0) r0 = syz_io_uring_setup(0x109, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x81}) io_uring_enter(r0, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12015002eebc1240ac052a021b5701f5020109022400010d1f10a70904020502034a02ff0905021b284d0905090905040300"], &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x1000, 0xffffff81) (async) creat(&(0x7f0000000380)='./file0\x00', 0x0) (async) syz_io_uring_setup(0x109, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3}, &(0x7f00000000c0), &(0x7f0000000280)) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r1, r2, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x81}) (async) io_uring_enter(r0, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12015002eebc1240ac052a021b5701f5020109022400010d1f10a70904020502034a02ff0905021b284d0905090905040300"], &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0}) (async) 0s ago: executing program 4 (id=3898): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockname$inet(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x122) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000400)=@v3={0x3000000, [{0x9, 0x1}, {0x0, 0x3d9b}]}, 0x18, 0x1) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], &(0x7f00000002c0)=""/203, 0xfffffffffffffe5f) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) fsopen(&(0x7f0000000040)='afs\x00', 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x5) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x8010, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffdd5}, 0x94) sched_getattr(0x0, &(0x7f0000000180)={0x38}, 0x38, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1}, 0xc) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, {0xa, 0x0, 0x0, @mcast1, 0xfffffffd}, 0x0, {[0x0, 0x0, 0x8, 0x0, 0x0, 0x4, 0x0, 0x800]}}, 0x5c) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, 0x0, 0x0) kernel console output (not intermixed with test programs): 24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1114.596782][ T5885] usb 3-1: New USB device found, idVendor=1b80, idProduct=e396, bcdDevice=a7.b1 [ 1114.606421][ T5885] usb 3-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1114.615033][ T24] usb 2-1: Product: syz [ 1114.618471][ T5907] usb 1-1: Using ep0 maxpacket: 8 [ 1114.619791][ T24] usb 2-1: Manufacturer: syz [ 1114.626386][ T5907] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1114.639328][ T5907] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1114.650670][ T5885] usb 3-1: Manufacturer: syz [ 1114.664171][ T5885] usb 3-1: config 0 descriptor?? [ 1114.675472][ T24] usb 2-1: SerialNumber: syz [ 1114.683824][ T5907] usb 1-1: config 0 descriptor?? [ 1114.829005][ T10] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -71 [ 1114.866203][ T10] usb 4-1: USB disconnect, device number 116 [ 1114.926515][ T5885] usb 3-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1115.050863][ T5885] dvb_usb_af9015 3-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 1115.088800][ T5885] usb 3-1: USB disconnect, device number 89 [ 1115.343029][T19634] program syz.4.3673 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1115.362480][T19634] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3673'. [ 1115.555215][T19639] FAULT_INJECTION: forcing a failure. [ 1115.555215][T19639] name failslab, interval 1, probability 0, space 0, times 0 [ 1115.582760][T19639] CPU: 1 UID: 0 PID: 19639 Comm: syz.4.3675 Not tainted syzkaller #0 PREEMPT(full) [ 1115.582789][T19639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1115.582800][T19639] Call Trace: [ 1115.582809][T19639] [ 1115.582817][T19639] dump_stack_lvl+0x189/0x250 [ 1115.582842][T19639] ? __pfx____ratelimit+0x10/0x10 [ 1115.582870][T19639] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1115.582889][T19639] ? __pfx__printk+0x10/0x10 [ 1115.582914][T19639] ? __pfx___might_resched+0x10/0x10 [ 1115.582936][T19639] ? fs_reclaim_acquire+0x7d/0x100 [ 1115.582962][T19639] should_fail_ex+0x414/0x560 [ 1115.582995][T19639] should_failslab+0xa8/0x100 [ 1115.583019][T19639] __kmalloc_noprof+0xcb/0x7f0 [ 1115.583046][T19639] ? tomoyo_encode+0x28b/0x550 [ 1115.583073][T19639] tomoyo_encode+0x28b/0x550 [ 1115.583099][T19639] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1115.583135][T19639] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1115.583161][T19639] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1115.583188][T19639] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1115.583213][T19639] ? get_pid_task+0x20/0x1f0 [ 1115.583235][T19639] ? lock_acquire+0x175/0x360 [ 1115.583263][T19639] ? __lock_acquire+0xab9/0xd20 [ 1115.583300][T19639] ? __fget_files+0x2a/0x420 [ 1115.583324][T19639] ? __fget_files+0x3a0/0x420 [ 1115.583341][T19639] ? __fget_files+0x2a/0x420 [ 1115.583366][T19639] security_file_ioctl_compat+0xcb/0x2d0 [ 1115.583392][T19639] __ia32_compat_sys_ioctl+0x128/0x840 [ 1115.583412][T19639] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1115.583429][T19639] ? __fget_files+0x3a0/0x420 [ 1115.583454][T19639] ? fput+0xa0/0xd0 [ 1115.583476][T19639] ? ksys_write+0x22a/0x250 [ 1115.583493][T19639] ? exc_page_fault+0x82/0x100 [ 1115.583511][T19639] ? __pfx_ksys_write+0x10/0x10 [ 1115.583530][T19639] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1115.583548][T19639] ? lockdep_hardirqs_on+0x9c/0x150 [ 1115.583568][T19639] __do_fast_syscall_32+0xb6/0x2b0 [ 1115.583586][T19639] ? lockdep_hardirqs_on+0x9c/0x150 [ 1115.583607][T19639] do_fast_syscall_32+0x34/0x80 [ 1115.583625][T19639] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1115.583646][T19639] RIP: 0023:0xf6ffd539 [ 1115.583661][T19639] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1115.583676][T19639] RSP: 002b:00000000f53ed55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1115.583694][T19639] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0306201 [ 1115.583706][T19639] RDX: 00000000800002c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 1115.583716][T19639] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1115.583725][T19639] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1115.583735][T19639] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1115.583761][T19639] [ 1115.583860][T19639] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1115.883084][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.890029][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.899983][ T10] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 1116.058425][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 1116.067193][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1116.078457][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1116.089195][ T10] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1116.100745][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1116.113438][ T10] usb 4-1: config 0 descriptor?? [ 1116.129352][ T10] hub 4-1:0.0: USB hub found [ 1116.335544][ T10] hub 4-1:0.0: 1 port detected [ 1116.564860][T19650] netlink: 148 bytes leftover after parsing attributes in process `syz.4.3678'. [ 1116.608867][T19650] syz.4.3678 (19650): drop_caches: 2 [ 1116.627444][T19650] IPv6: Can't replace route, no match found [ 1116.961283][T19641] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1116.977276][ T24] usb 2-1: USB disconnect, device number 89 [ 1116.993521][T19641] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1117.080111][ T10] hub 4-1:0.0: activate --> -90 [ 1117.138689][ T5885] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 1117.152956][ T5907] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1117.167354][ T5907] asix 1-1:0.0: probe with driver asix failed with error -71 [ 1117.502254][ T24] usb 4-1: USB disconnect, device number 117 [ 1117.510720][ T10] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 1117.523107][ T5907] usb 1-1: USB disconnect, device number 109 [ 1117.588974][T19657] netlink: 260 bytes leftover after parsing attributes in process `syz.0.3681'. [ 1117.632747][T19654] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3680'. [ 1117.648586][ T5885] usb 3-1: Using ep0 maxpacket: 16 [ 1117.655947][ T5885] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1117.677993][ T5885] usb 3-1: config 0 has no interfaces? [ 1117.687823][ T5885] usb 3-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1117.707463][ T5885] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1117.727153][ T5885] usb 3-1: config 0 descriptor?? [ 1118.292490][T19674] program syz.1.3685 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1118.371733][T19674] netlink: 88 bytes leftover after parsing attributes in process `syz.1.3685'. [ 1118.394925][ T30] kauditd_printk_skb: 51 callbacks suppressed [ 1118.394942][ T30] audit: type=1326 audit(1760348192.535:1855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19675 comm="syz.3.3686" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf700d539 code=0x0 [ 1118.790465][T19685] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3687'. [ 1119.146496][ T30] audit: type=1326 audit(1760348193.285:1856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19691 comm="syz.0.3690" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1119.169294][ T5885] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 1119.228794][ T30] audit: type=1326 audit(1760348193.315:1857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19691 comm="syz.0.3690" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1119.251158][ T30] audit: type=1326 audit(1760348193.325:1858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19691 comm="syz.0.3690" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1119.273837][ T30] audit: type=1326 audit(1760348193.325:1859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19691 comm="syz.0.3690" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1119.314583][ T30] audit: type=1326 audit(1760348193.325:1860): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19691 comm="syz.0.3690" exe="/root/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1119.376861][ T30] audit: type=1326 audit(1760348193.325:1861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19691 comm="syz.0.3690" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1119.398523][ T9] usb 2-1: new low-speed USB device number 90 using dummy_hcd [ 1119.411244][ T5885] usb 5-1: New USB device found, idVendor=1b80, idProduct=e396, bcdDevice=a7.b1 [ 1119.422115][ T5885] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1119.431251][ T5885] usb 5-1: Manufacturer: syz [ 1119.437734][ T5885] usb 5-1: config 0 descriptor?? [ 1119.444737][ T30] audit: type=1326 audit(1760348193.325:1862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19691 comm="syz.0.3690" exe="/root/syz-executor" sig=0 arch=40000003 syscall=226 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1119.468093][ T30] audit: type=1326 audit(1760348193.325:1863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19691 comm="syz.0.3690" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1119.502943][ T30] audit: type=1326 audit(1760348193.325:1864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19691 comm="syz.0.3690" exe="/root/syz-executor" sig=0 arch=40000003 syscall=227 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1119.712283][ T5907] usb 3-1: USB disconnect, device number 90 [ 1119.722699][ T5885] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1119.731250][ T5885] dvb_usb_af9015 5-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 1119.765384][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1119.797297][ T9] usb 2-1: config 1 has an invalid interface number: 181 but max is 0 [ 1119.813441][ T9] usb 2-1: config 1 has no interface number 0 [ 1119.823640][ T9] usb 2-1: config 1 interface 181 altsetting 1 endpoint 0xE has invalid maxpacket 64, setting to 8 [ 1119.849044][ T9] usb 2-1: config 1 interface 181 has no altsetting 0 [ 1119.868248][ T5885] usb 5-1: USB disconnect, device number 106 [ 1119.883839][T19702] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3691'. [ 1120.104004][ T9] usb 2-1: string descriptor 0 read error: -22 [ 1120.111200][ T9] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=1d.74 [ 1120.139705][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1120.200415][ T9] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1120.843173][T19707] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3692'. [ 1121.042495][T19714] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3693'. [ 1121.248753][T17726] usb 2-1: Failed to submit usb control message: -110 [ 1121.258457][ T9] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1121.276146][T17726] usb 2-1: unable to send the bmi data to the device: -110 [ 1121.284182][T17726] usb 2-1: unable to get target info from device [ 1121.290726][T17726] usb 2-1: could not get target info (-110) [ 1121.297966][T17726] usb 2-1: could not probe fw (-110) [ 1121.518510][ T9] usb 3-1: device descriptor read/64, error -71 [ 1121.748413][ T5885] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 1121.808486][ T43] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 1121.808483][ T9] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1121.877502][ T10] usb 2-1: USB disconnect, device number 90 [ 1121.988453][ T9] usb 3-1: device descriptor read/64, error -71 [ 1122.018610][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 1122.025873][ T5885] usb 5-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 1122.042825][ T43] usb 4-1: config 0 has no interfaces? [ 1122.048700][ T43] usb 4-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 1122.057977][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1122.076695][ T5885] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1122.098768][ T9] usb usb3-port1: attempt power cycle [ 1122.101639][ T5885] usb 5-1: config 0 descriptor?? [ 1122.110683][ T43] usb 4-1: config 0 descriptor?? [ 1122.124042][ T5885] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 1122.374527][T19727] input: syz0 as /devices/virtual/input/input65 [ 1122.413223][T19719] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1122.426055][T19719] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1122.448661][ T9] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1122.463554][T19720] gtp0: entered promiscuous mode [ 1122.479626][ T9] usb 3-1: device descriptor read/8, error -71 [ 1122.505104][T19720] gtp0: entered allmulticast mode [ 1122.559827][ T5885] usb 5-1: USB disconnect, device number 107 [ 1122.718488][ T9] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1122.749364][ T9] usb 3-1: device descriptor read/8, error -71 [ 1122.858933][ T9] usb usb3-port1: unable to enumerate USB device [ 1123.558578][ T9] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 1123.788439][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 1123.805673][ T9] usb 1-1: config 0 has an invalid interface number: 4 but max is 0 [ 1123.827061][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1123.841288][ T9] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 1123.850964][ T9] usb 1-1: config 0 has no interface number 1 [ 1123.857333][ T9] usb 1-1: config 0 interface 4 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1123.874909][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=08b0, bcdDevice=e5.27 [ 1123.894762][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1123.932276][ T9] usb 1-1: Product: syz [ 1123.939166][ T9] usb 1-1: Manufacturer: syz [ 1123.961069][ T9] usb 1-1: SerialNumber: syz [ 1124.064159][ T9] usb 1-1: config 0 descriptor?? [ 1124.076489][ T9] pwc: Logitech QuickCam Pro 3000 USB webcam detected. [ 1124.247017][ T10] usb 2-1: new low-speed USB device number 91 using dummy_hcd [ 1124.274488][ T9] pwc: Failed to set LED on/off time (-71) [ 1124.281674][ T9] pwc: send_video_command error -71 [ 1124.287117][ T9] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 1124.296226][ T9] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 1124.323769][ T9] usb 1-1: USB disconnect, device number 110 [ 1124.417681][ T10] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1124.428717][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1124.468641][ T10] usb 2-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 1124.491422][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1124.585487][ T10] usb 2-1: config 0 descriptor?? [ 1124.585584][ T43] usb 4-1: USB disconnect, device number 118 [ 1124.649785][ T10] qmi_wwan 2-1:0.0: probe with driver qmi_wwan failed with error -22 [ 1125.289612][T19770] netlink: 1284 bytes leftover after parsing attributes in process `syz.3.3707'. [ 1125.327231][T19770] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3707'. [ 1125.602011][T19775] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3709'. [ 1125.628378][ T43] usb 1-1: new low-speed USB device number 111 using dummy_hcd [ 1125.628443][ T10] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1125.861576][ T43] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1125.871766][ T43] usb 1-1: config 1 has an invalid interface number: 181 but max is 0 [ 1125.891915][ T43] usb 1-1: config 1 has no interface number 0 [ 1125.910767][ T43] usb 1-1: config 1 interface 181 altsetting 1 endpoint 0xE has invalid maxpacket 64, setting to 8 [ 1125.973737][ T43] usb 1-1: config 1 interface 181 has no altsetting 0 [ 1126.034106][ T43] usb 1-1: string descriptor 0 read error: -22 [ 1126.051141][ T43] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=1d.74 [ 1126.068422][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 1126.076387][ T10] usb 3-1: config index 0 descriptor too short (expected 49041, got 36) [ 1126.084996][ T10] usb 3-1: config 97 has too many interfaces: 232, using maximum allowed: 32 [ 1126.092861][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1126.114693][ T10] usb 3-1: config 97 has an invalid descriptor of length 248, skipping remainder of the config [ 1126.213662][ T43] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1126.223500][ T10] usb 3-1: config 97 has 0 interfaces, different from the descriptor's value: 232 [ 1126.237974][ T10] usb 3-1: New USB device found, idVendor=1e71, idProduct=170e, bcdDevice= 0.00 [ 1126.247351][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1126.506810][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 1126.506828][ T30] audit: type=1326 audit(1760348200.635:1899): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1127.086353][ T30] audit: type=1326 audit(1760348200.635:1900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1127.117814][ T30] audit: type=1326 audit(1760348200.635:1901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1127.286702][T17726] usb 1-1: Failed to submit usb control message: -110 [ 1127.298439][T17726] usb 1-1: unable to send the bmi data to the device: -110 [ 1127.320100][ T43] usb 2-1: USB disconnect, device number 91 [ 1127.345045][T17726] usb 1-1: unable to get target info from device [ 1127.365048][T17726] usb 1-1: could not get target info (-110) [ 1127.383981][T17726] usb 1-1: could not probe fw (-110) [ 1127.403437][ T30] audit: type=1326 audit(1760348200.635:1902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1127.554762][ T30] audit: type=1326 audit(1760348200.635:1903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1127.596220][ T30] audit: type=1326 audit(1760348200.635:1904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1127.626200][ T30] audit: type=1326 audit(1760348200.635:1905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=226 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1127.660937][T19793] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3712'. [ 1127.744786][ T30] audit: type=1326 audit(1760348200.635:1906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1127.854452][ T30] audit: type=1326 audit(1760348200.635:1907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=227 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1127.982863][ T30] audit: type=1326 audit(1760348200.635:1908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19781 comm="syz.3.3711" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1128.219350][ T5907] usb 1-1: USB disconnect, device number 111 [ 1128.413158][T19795] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3713'. [ 1128.468923][ T43] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 1128.482665][T19801] FAULT_INJECTION: forcing a failure. [ 1128.482665][T19801] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1128.510278][T19801] CPU: 1 UID: 0 PID: 19801 Comm: syz.0.3715 Not tainted syzkaller #0 PREEMPT(full) [ 1128.510303][T19801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1128.510316][T19801] Call Trace: [ 1128.510324][T19801] [ 1128.510332][T19801] dump_stack_lvl+0x189/0x250 [ 1128.510359][T19801] ? __pfx____ratelimit+0x10/0x10 [ 1128.510386][T19801] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1128.510405][T19801] ? __pfx__printk+0x10/0x10 [ 1128.510437][T19801] should_fail_ex+0x414/0x560 [ 1128.510469][T19801] _copy_to_user+0x31/0xb0 [ 1128.510493][T19801] simple_read_from_buffer+0xe1/0x170 [ 1128.510519][T19801] proc_fail_nth_read+0x1b3/0x220 [ 1128.510548][T19801] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1128.510576][T19801] ? rw_verify_area+0x2a6/0x4d0 [ 1128.510593][T19801] ? __lock_acquire+0xab9/0xd20 [ 1128.510612][T19801] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1128.510643][T19801] vfs_read+0x200/0xa30 [ 1128.510660][T19801] ? fdget_pos+0x247/0x320 [ 1128.510684][T19801] ? __pfx___mutex_lock+0x10/0x10 [ 1128.510704][T19801] ? __pfx_vfs_read+0x10/0x10 [ 1128.510728][T19801] ? __fget_files+0x2a/0x420 [ 1128.510753][T19801] ? __fget_files+0x3a0/0x420 [ 1128.510772][T19801] ? __fget_files+0x2a/0x420 [ 1128.510802][T19801] ksys_read+0x145/0x250 [ 1128.510820][T19801] ? exc_page_fault+0x82/0x100 [ 1128.510838][T19801] ? __pfx_ksys_read+0x10/0x10 [ 1128.510860][T19801] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1128.510881][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 1128.510903][T19801] __do_fast_syscall_32+0xb6/0x2b0 [ 1128.510923][T19801] ? lockdep_hardirqs_on+0x9c/0x150 [ 1128.510946][T19801] do_fast_syscall_32+0x34/0x80 [ 1128.510965][T19801] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1128.510987][T19801] RIP: 0023:0xf70ad539 [ 1128.511011][T19801] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1128.511027][T19801] RSP: 002b:00000000f549d590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1128.511047][T19801] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f549d620 [ 1128.511060][T19801] RDX: 000000000000000f RSI: 00000000f7445ff4 RDI: 0000000000000000 [ 1128.511071][T19801] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 1128.511083][T19801] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1128.511094][T19801] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1128.511124][T19801] [ 1128.759650][ C1] vkms_vblank_simulate: vblank timer overrun [ 1128.812436][ T10] usb 3-1: string descriptor 0 read error: -71 [ 1128.876934][ T10] usb 3-1: USB disconnect, device number 95 [ 1128.908472][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 1128.915383][ T43] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1128.924016][ T43] usb 4-1: config 0 has no interface number 0 [ 1128.947842][ T43] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1128.957860][ T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1128.965937][ T43] usb 4-1: Product: syz [ 1128.970267][ T43] usb 4-1: Manufacturer: syz [ 1128.974927][ T43] usb 4-1: SerialNumber: syz [ 1128.980530][ T5885] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 1128.989348][ T43] usb 4-1: config 0 descriptor?? [ 1128.996909][ T43] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1129.005765][ T43] usb 4-1: selecting invalid altsetting 1 [ 1129.011529][ T43] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1129.020514][ T43] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1129.031045][ T43] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1129.039440][ T43] usb 4-1: media controller created [ 1129.075056][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1129.118468][ T5885] usb 5-1: device descriptor read/64, error -71 [ 1129.201325][T19799] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1129.217653][T19799] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1129.243350][T19811] FAULT_INJECTION: forcing a failure. [ 1129.243350][T19811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1129.270690][T19799] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3714'. [ 1129.272487][T19811] CPU: 1 UID: 0 PID: 19811 Comm: syz.2.3719 Not tainted syzkaller #0 PREEMPT(full) [ 1129.272511][T19811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1129.272523][T19811] Call Trace: [ 1129.272530][T19811] [ 1129.272539][T19811] dump_stack_lvl+0x189/0x250 [ 1129.272565][T19811] ? __pfx____ratelimit+0x10/0x10 [ 1129.272594][T19811] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1129.272613][T19811] ? __pfx__printk+0x10/0x10 [ 1129.272631][T19811] ? __might_fault+0xb0/0x130 [ 1129.272660][T19811] should_fail_ex+0x414/0x560 [ 1129.272690][T19811] _copy_from_iter+0x1de/0x1790 [ 1129.272714][T19811] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1129.272744][T19811] ? policy_nodemask+0x27c/0x720 [ 1129.272766][T19811] ? __pfx__copy_from_iter+0x10/0x10 [ 1129.272792][T19811] ? set_page_refcounted+0xa0/0x1e0 [ 1129.272813][T19811] ? page_copy_sane+0x4e/0x280 [ 1129.272835][T19811] copy_page_from_iter+0xdd/0x170 [ 1129.272860][T19811] tun_get_user+0x1d7b/0x3e90 [ 1129.272889][T19811] ? tun_get_user+0x6f6/0x3e90 [ 1129.272917][T19811] ? aa_file_perm+0x44d/0x1550 [ 1129.272957][T19811] ? __pfx_tun_get_user+0x10/0x10 [ 1129.272976][T19811] ? _parse_integer_limit+0x1ae/0x1f0 [ 1129.273003][T19811] ? __lock_acquire+0xab9/0xd20 [ 1129.273036][T19811] ? ref_tracker_alloc+0x318/0x460 [ 1129.273059][T19811] ? __lock_acquire+0xab9/0xd20 [ 1129.273082][T19811] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 1129.273105][T19811] ? tun_get+0x1c/0x2f0 [ 1129.273135][T19811] ? tun_get+0x1c/0x2f0 [ 1129.273155][T19811] ? tun_get+0x1c/0x2f0 [ 1129.273180][T19811] tun_chr_write_iter+0x113/0x200 [ 1129.273203][T19811] vfs_write+0x5c9/0xb30 [ 1129.273226][T19811] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 1129.273248][T19811] ? __pfx_vfs_write+0x10/0x10 [ 1129.273276][T19811] ? __fget_files+0x2a/0x420 [ 1129.273304][T19811] ksys_write+0x145/0x250 [ 1129.273322][T19811] ? exc_page_fault+0x82/0x100 [ 1129.273340][T19811] ? __pfx_ksys_write+0x10/0x10 [ 1129.273361][T19811] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1129.273380][T19811] ? lockdep_hardirqs_on+0x9c/0x150 [ 1129.273400][T19811] __do_fast_syscall_32+0xb6/0x2b0 [ 1129.273419][T19811] ? lockdep_hardirqs_on+0x9c/0x150 [ 1129.273443][T19811] do_fast_syscall_32+0x34/0x80 [ 1129.273462][T19811] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1129.273483][T19811] RIP: 0023:0xf7fd2539 [ 1129.273499][T19811] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1129.273514][T19811] RSP: 002b:00000000f54c6520 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 1129.273533][T19811] RAX: ffffffffffffffda RBX: 00000000000000c8 RCX: 0000000080000180 [ 1129.273546][T19811] RDX: 000000000000003a RSI: 00000000f7465ff4 RDI: 0000000000000000 [ 1129.273557][T19811] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1129.273568][T19811] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1129.273578][T19811] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1129.273605][T19811] [ 1129.378517][ T5885] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 1129.778459][ T5885] usb 5-1: device descriptor read/64, error -71 [ 1129.888623][ T5885] usb usb5-port1: attempt power cycle [ 1129.918402][ T5907] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1130.068415][ T5907] usb 3-1: Using ep0 maxpacket: 16 [ 1130.075448][ T5907] usb 3-1: config 0 has an invalid interface number: 251 but max is 0 [ 1130.084244][ T5907] usb 3-1: config 0 has no interface number 0 [ 1130.092853][ T5907] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 16 [ 1130.121853][ T5907] usb 3-1: config 0 interface 251 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 1130.135185][ T5907] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1130.145791][ T5907] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1130.154760][ T5907] usb 3-1: Product: syz [ 1130.161653][ T5907] usb 3-1: Manufacturer: syz [ 1130.166463][ T5907] usb 3-1: SerialNumber: syz [ 1130.180111][ T5907] usb 3-1: config 0 descriptor?? [ 1130.264934][ T5885] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 1130.265373][T19824] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1130.285346][T19824] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1130.289037][ T43] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1130.302009][ T5885] usb 5-1: device descriptor read/8, error -71 [ 1130.317485][ T43] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1130.541012][T19824] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1130.549169][ T5885] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 1130.557487][T19824] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1130.569050][ T5885] usb 5-1: device descriptor read/8, error -71 [ 1130.593904][T19830] FAULT_INJECTION: forcing a failure. [ 1130.593904][T19830] name failslab, interval 1, probability 0, space 0, times 0 [ 1130.607116][T19830] CPU: 0 UID: 0 PID: 19830 Comm: syz.1.3724 Not tainted syzkaller #0 PREEMPT(full) [ 1130.607140][T19830] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1130.607152][T19830] Call Trace: [ 1130.607159][T19830] [ 1130.607168][T19830] dump_stack_lvl+0x189/0x250 [ 1130.607194][T19830] ? __pfx____ratelimit+0x10/0x10 [ 1130.607225][T19830] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1130.607244][T19830] ? __pfx__printk+0x10/0x10 [ 1130.607268][T19830] ? __pfx___might_resched+0x10/0x10 [ 1130.607292][T19830] ? fs_reclaim_acquire+0x7d/0x100 [ 1130.607319][T19830] should_fail_ex+0x414/0x560 [ 1130.607351][T19830] should_failslab+0xa8/0x100 [ 1130.607376][T19830] kmem_cache_alloc_node_noprof+0x77/0x710 [ 1130.607396][T19830] ? __alloc_skb+0x112/0x2d0 [ 1130.607419][T19830] ? netlink_autobind+0xdb/0x300 [ 1130.607449][T19830] __alloc_skb+0x112/0x2d0 [ 1130.607477][T19830] netlink_sendmsg+0x5c6/0xb30 [ 1130.607510][T19830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1130.607536][T19830] ? __import_iovec+0x5d4/0x7f0 [ 1130.607558][T19830] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1130.607579][T19830] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1130.607602][T19830] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1130.607628][T19830] __sock_sendmsg+0x21c/0x270 [ 1130.607653][T19830] ____sys_sendmsg+0x505/0x830 [ 1130.607684][T19830] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1130.607725][T19830] ___sys_sendmsg+0x21f/0x2a0 [ 1130.607743][T19830] ? __pfx____sys_sendmsg+0x10/0x10 [ 1130.607809][T19830] ? __fget_files+0x2a/0x420 [ 1130.607831][T19830] ? __fget_files+0x3a0/0x420 [ 1130.607862][T19830] __sys_sendmsg+0x164/0x220 [ 1130.607891][T19830] ? __pfx___sys_sendmsg+0x10/0x10 [ 1130.607926][T19830] ? __pfx_ksys_write+0x10/0x10 [ 1130.607949][T19830] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1130.607971][T19830] ? lockdep_hardirqs_on+0x9c/0x150 [ 1130.607992][T19830] __do_fast_syscall_32+0xb6/0x2b0 [ 1130.608013][T19830] ? lockdep_hardirqs_on+0x9c/0x150 [ 1130.608035][T19830] do_fast_syscall_32+0x34/0x80 [ 1130.608055][T19830] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1130.608077][T19830] RIP: 0023:0xf703d539 [ 1130.608093][T19830] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1130.608109][T19830] RSP: 002b:00000000f542d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1130.608128][T19830] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 1130.608142][T19830] RDX: 0000000004000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 1130.608153][T19830] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1130.608164][T19830] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1130.608175][T19830] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1130.608202][T19830] [ 1130.718740][ T5885] usb usb5-port1: unable to enumerate USB device [ 1131.265740][T19840] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3726'. [ 1131.439284][ T43] usb 4-1: USB disconnect, device number 119 [ 1131.613852][T14548] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 1131.791097][T14548] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1131.806200][T14548] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1131.875153][T14548] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 1131.884567][T14548] usb 1-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 1131.898402][T14548] usb 1-1: Product: syz [ 1131.905684][T14548] usb 1-1: config 0 descriptor?? [ 1131.921615][T14548] usbhid 1-1:0.0: can't add hid device: -22 [ 1131.928825][T14548] usbhid 1-1:0.0: probe with driver usbhid failed with error -22 [ 1132.380111][T19824] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1132.405883][T19824] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1132.753621][T19855] FAULT_INJECTION: forcing a failure. [ 1132.753621][T19855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1132.769033][T19855] CPU: 0 UID: 0 PID: 19855 Comm: syz.1.3730 Not tainted syzkaller #0 PREEMPT(full) [ 1132.769060][T19855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1132.769073][T19855] Call Trace: [ 1132.769080][T19855] [ 1132.769090][T19855] dump_stack_lvl+0x189/0x250 [ 1132.769119][T19855] ? __pfx____ratelimit+0x10/0x10 [ 1132.769151][T19855] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1132.769171][T19855] ? __pfx__printk+0x10/0x10 [ 1132.769203][T19855] should_fail_ex+0x414/0x560 [ 1132.769235][T19855] _copy_to_user+0x31/0xb0 [ 1132.769261][T19855] simple_read_from_buffer+0xe1/0x170 [ 1132.769288][T19855] proc_fail_nth_read+0x1b3/0x220 [ 1132.769316][T19855] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1132.769346][T19855] ? rw_verify_area+0x2a6/0x4d0 [ 1132.769363][T19855] ? __lock_acquire+0xab9/0xd20 [ 1132.769384][T19855] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1132.769411][T19855] vfs_read+0x200/0xa30 [ 1132.769429][T19855] ? fdget_pos+0x247/0x320 [ 1132.769455][T19855] ? __pfx___mutex_lock+0x10/0x10 [ 1132.769474][T19855] ? __pfx_vfs_read+0x10/0x10 [ 1132.769495][T19855] ? __fget_files+0x2a/0x420 [ 1132.769520][T19855] ? __fget_files+0x3a0/0x420 [ 1132.769541][T19855] ? __fget_files+0x2a/0x420 [ 1132.769577][T19855] ksys_read+0x145/0x250 [ 1132.769599][T19855] ? __pfx_ksys_read+0x10/0x10 [ 1132.769622][T19855] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1132.769643][T19855] ? lockdep_hardirqs_on+0x9c/0x150 [ 1132.769664][T19855] __do_fast_syscall_32+0xb6/0x2b0 [ 1132.769691][T19855] do_fast_syscall_32+0x34/0x80 [ 1132.769711][T19855] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1132.769732][T19855] RIP: 0023:0xf703d539 [ 1132.769749][T19855] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1132.769764][T19855] RSP: 002b:00000000f542d590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1132.769784][T19855] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000f542d620 [ 1132.769797][T19855] RDX: 000000000000000f RSI: 00000000f73d5ff4 RDI: 0000000000000000 [ 1132.769808][T19855] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 1132.769819][T19855] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1132.769830][T19855] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1132.769860][T19855] [ 1133.028150][T19862] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3731'. [ 1133.355369][T19824] netlink: 120 bytes leftover after parsing attributes in process `syz.2.3722'. [ 1133.379743][T19865] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1133.392426][T19865] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1133.511398][T19868] netlink: 148 bytes leftover after parsing attributes in process `syz.3.3732'. [ 1133.620128][ T5907] asix 3-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0002: -71 [ 1133.651835][ T5907] asix 3-1:0.251 (unnamed net_device) (uninitialized): Could not register MDIO bus [ 1133.666648][ T5907] asix 3-1:0.251: probe with driver asix failed with error -5 [ 1133.680437][T19871] IPv6: Can't replace route, no match found [ 1133.712438][ T5907] usb 3-1: USB disconnect, device number 96 [ 1133.943785][T19868] syz.3.3732 (19868): drop_caches: 2 [ 1134.438386][ T5907] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 1134.658588][ T5907] usb 5-1: Using ep0 maxpacket: 8 [ 1134.692371][ T5907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1134.748279][ T5907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1134.758206][ T5907] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1134.787692][ T5907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12336, setting to 1024 [ 1134.802259][ T5907] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1134.816242][ T5907] usb 5-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1134.825981][ T5907] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1134.839791][ T5907] usb 5-1: config 0 descriptor?? [ 1134.868437][T19873] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1134.880622][ T43] usb 1-1: USB disconnect, device number 112 [ 1134.918664][T14548] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 1135.092933][T14548] usb 4-1: Using ep0 maxpacket: 16 [ 1135.118587][T19883] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3736'. [ 1135.139460][T14548] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1135.158041][T14548] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1135.194385][T14548] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1135.196714][ T9] usb 5-1: USB disconnect, device number 112 [ 1135.203990][T14548] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1135.218236][ T5822] Bluetooth: hci4: Opcode 0x0c03 failed: -19 [ 1135.228419][T14548] usb 4-1: Product: syz [ 1135.232688][T14548] usb 4-1: Manufacturer: syz [ 1135.237499][T14548] usb 4-1: SerialNumber: syz [ 1135.368936][ T5907] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1135.728601][T14548] usb 4-1: 0:2 : does not exist [ 1135.778664][ T5907] usb 2-1: device descriptor read/64, error -71 [ 1135.781171][T14548] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1135.875351][T14548] usb 4-1: USB disconnect, device number 120 [ 1136.018413][ T5907] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1136.168401][ T5907] usb 2-1: device descriptor read/64, error -71 [ 1136.368422][ T43] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 1136.399431][T19897] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3740'. [ 1136.409218][ T5907] usb usb2-port1: attempt power cycle [ 1136.453099][T19897] syz.0.3740 (19897): drop_caches: 2 [ 1136.474721][T19897] IPv6: Can't replace route, no match found [ 1136.549180][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 1136.556463][ T43] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1136.565042][ T43] usb 5-1: config 0 has no interface number 0 [ 1136.574786][ T43] usb 5-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1136.584145][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1136.595780][ T43] usb 5-1: Product: syz [ 1136.605751][ T43] usb 5-1: Manufacturer: syz [ 1136.695142][ T43] usb 5-1: SerialNumber: syz [ 1136.721093][T19905] netlink: 1284 bytes leftover after parsing attributes in process `syz.3.3741'. [ 1136.764731][ T43] usb 5-1: config 0 descriptor?? [ 1136.818981][ T5907] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1136.845243][ T5907] usb 2-1: device descriptor read/8, error -71 [ 1137.070954][ T43] usb 5-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1137.138717][ T43] usb 5-1: selecting invalid altsetting 1 [ 1137.144507][ T43] usb 5-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1137.149716][ T5907] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1137.162590][ T43] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1137.176838][ T43] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1137.187872][ T43] usb 5-1: media controller created [ 1137.199939][T14572] usb 3-1: new full-speed USB device number 97 using dummy_hcd [ 1137.310664][ T5907] usb 2-1: device descriptor read/8, error -71 [ 1137.361556][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1137.374157][T19890] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1137.383256][T19890] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1137.397937][T19890] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3738'. [ 1137.418887][ T5907] usb usb2-port1: unable to enumerate USB device [ 1137.478396][T14572] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1137.490028][T14572] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1137.499980][T14572] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1137.719860][T14572] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1137.771144][T14572] usb 3-1: config 0 descriptor?? [ 1138.060920][T19910] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3742'. [ 1138.333034][ T5907] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 1138.434149][T19895] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3739'. [ 1138.514175][ T5907] usb 1-1: New USB device found, idVendor=1b80, idProduct=e396, bcdDevice=a7.b1 [ 1138.523611][ T5907] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1138.532225][ T5907] usb 1-1: Manufacturer: syz [ 1138.543349][ T5907] usb 1-1: config 0 descriptor?? [ 1138.748762][ T43] usb 5-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1138.755883][ T43] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1138.767450][ T5907] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1138.941746][ T5907] dvb_usb_af9015 1-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 1138.964544][ T5907] usb 1-1: USB disconnect, device number 113 [ 1139.385039][ T43] usb 5-1: USB disconnect, device number 113 [ 1139.619351][T19931] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3746'. [ 1139.637948][T19931] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3746'. [ 1139.795963][T14572] usbhid 3-1:0.0: can't add hid device: -71 [ 1139.807432][T14572] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1139.886868][T14572] usb 3-1: USB disconnect, device number 97 [ 1139.918843][ T43] usb 2-1: new low-speed USB device number 96 using dummy_hcd [ 1140.000928][ T10] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 1140.091212][ T43] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1140.100320][ T43] usb 2-1: config 1 has an invalid interface number: 181 but max is 0 [ 1140.111391][ T43] usb 2-1: config 1 has no interface number 0 [ 1140.118090][ T43] usb 2-1: config 1 interface 181 altsetting 1 endpoint 0xE has invalid maxpacket 64, setting to 8 [ 1140.130611][ T43] usb 2-1: config 1 interface 181 has no altsetting 0 [ 1140.142343][ T43] usb 2-1: string descriptor 0 read error: -22 [ 1140.149131][ T43] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=1d.74 [ 1140.158267][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1140.186826][ T43] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1140.201962][ T10] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1140.219479][ T10] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1140.230661][ T10] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1140.259076][ T10] usb 5-1: config 1 has no interface number 1 [ 1140.265601][ T10] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1140.304497][ T10] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1140.314281][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1140.323480][ T10] usb 5-1: Product: syz [ 1140.328041][ T10] usb 5-1: Manufacturer: syz [ 1140.333890][ T10] usb 5-1: SerialNumber: syz [ 1140.734028][T19955] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3752'. [ 1140.820370][T19956] netlink: 148 bytes leftover after parsing attributes in process `syz.3.3753'. [ 1141.115493][T19958] syz.3.3753 (19958): drop_caches: 2 [ 1141.144177][T19956] IPv6: Can't replace route, no match found [ 1141.228784][ T66] usb 2-1: Failed to submit usb control message: -110 [ 1141.378477][ T66] usb 2-1: unable to send the bmi data to the device: -110 [ 1141.385991][ T66] usb 2-1: unable to get target info from device [ 1141.613782][ T66] usb 2-1: could not get target info (-110) [ 1141.622219][ T66] usb 2-1: could not probe fw (-110) [ 1142.037161][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 1142.037176][ T30] audit: type=1326 audit(1760348215.965:1943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1142.171939][ T30] audit: type=1326 audit(1760348215.965:1944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1142.196637][ C0] vkms_vblank_simulate: vblank timer overrun [ 1142.260759][ T30] audit: type=1326 audit(1760348215.965:1945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1142.433549][ T30] audit: type=1326 audit(1760348215.965:1946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1142.563560][ T5885] usb 2-1: USB disconnect, device number 96 [ 1142.648530][ T30] audit: type=1326 audit(1760348215.965:1947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1142.721231][ T10] usb 5-1: Failed to set altset [ 1142.726306][ T10] usb 5-1: 0:2: cannot create sequencer device [ 1142.838441][ T30] audit: type=1326 audit(1760348215.965:1948): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1142.860545][ C0] vkms_vblank_simulate: vblank timer overrun [ 1142.868521][ T10] usb 5-1: Failed to set altset [ 1143.191635][ T30] audit: type=1326 audit(1760348215.965:1949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=226 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1143.213739][ C0] vkms_vblank_simulate: vblank timer overrun [ 1143.225298][ T10] snd-usb-audio 5-1:1.2: probe with driver snd-usb-audio failed with error -71 [ 1143.455368][ T10] usb 5-1: USB disconnect, device number 114 [ 1143.799347][ T30] audit: type=1326 audit(1760348215.965:1950): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1144.117434][ T30] audit: type=1326 audit(1760348215.965:1951): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1144.200082][ T30] audit: type=1326 audit(1760348215.965:1952): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19959 comm="syz.2.3754" exe="/root/syz-executor" sig=0 arch=40000003 syscall=227 compat=1 ip=0xf7fd2539 code=0x7ffc0000 [ 1144.288868][ T5885] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 1144.374605][T19994] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3760'. [ 1144.448425][ T5885] usb 2-1: Using ep0 maxpacket: 8 [ 1144.484107][ T5885] usb 2-1: config index 0 descriptor too short (expected 49041, got 36) [ 1144.509846][ T5885] usb 2-1: config 97 has too many interfaces: 232, using maximum allowed: 32 [ 1144.553267][ T5885] usb 2-1: config 97 has an invalid descriptor of length 248, skipping remainder of the config [ 1144.578382][ T5885] usb 2-1: config 97 has 0 interfaces, different from the descriptor's value: 232 [ 1144.587949][ T5885] usb 2-1: New USB device found, idVendor=1e71, idProduct=170e, bcdDevice= 0.00 [ 1144.598449][ T5885] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1144.648569][ T43] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 1144.851557][ T43] usb 1-1: New USB device found, idVendor=1b80, idProduct=e396, bcdDevice=a7.b1 [ 1144.898509][ T43] usb 1-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1144.926864][ T43] usb 1-1: Manufacturer: syz [ 1144.939127][ T43] usb 1-1: config 0 descriptor?? [ 1145.071211][T20006] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3765'. [ 1145.262429][ T43] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1145.277150][ T43] dvb_usb_af9015 1-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 1145.334530][ T43] usb 1-1: USB disconnect, device number 114 [ 1145.440472][T20006] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1145.696558][T20013] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3766'. [ 1146.115682][T20018] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3768'. [ 1146.152403][T14572] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1146.322874][T14572] usb 3-1: Using ep0 maxpacket: 16 [ 1146.334210][T14572] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1146.345433][T14572] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1146.367032][T14572] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1146.376528][T14572] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1146.589356][T20023] netlink: 1284 bytes leftover after parsing attributes in process `syz.3.3769'. [ 1146.639034][T14572] usb 3-1: Product: syz [ 1146.670018][T14572] usb 3-1: Manufacturer: syz [ 1146.679595][T14572] usb 3-1: SerialNumber: syz [ 1146.856757][ T5885] usb 2-1: string descriptor 0 read error: -71 [ 1146.876514][ T5885] usb 2-1: USB disconnect, device number 97 [ 1146.923125][T14572] usb 3-1: 0:2 : does not exist [ 1147.008456][ T24] usb 1-1: new high-speed USB device number 115 using dummy_hcd [ 1147.015865][T14572] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 1147.359430][T14572] usb 3-1: USB disconnect, device number 98 [ 1147.397773][ T6020] udevd[6020]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1147.434794][ T24] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1147.445696][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1147.457488][ T24] usb 1-1: Product: syz [ 1147.464169][ T24] usb 1-1: Manufacturer: syz [ 1147.471298][ T24] usb 1-1: SerialNumber: syz [ 1147.483138][ T24] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1147.505800][ T43] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1147.813495][ T5885] usb 1-1: USB disconnect, device number 115 [ 1147.819622][T20033] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3773'. [ 1148.026895][T20040] ..@: renamed from bond_slave_0 (while UP) [ 1148.088915][T20042] FAULT_INJECTION: forcing a failure. [ 1148.088915][T20042] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1148.102851][T20042] CPU: 1 UID: 0 PID: 20042 Comm: syz.4.3776 Not tainted syzkaller #0 PREEMPT(full) [ 1148.102888][T20042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1148.102905][T20042] Call Trace: [ 1148.102918][T20042] [ 1148.102930][T20042] dump_stack_lvl+0x189/0x250 [ 1148.102962][T20042] ? __pfx____ratelimit+0x10/0x10 [ 1148.102987][T20042] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1148.103003][T20042] ? __pfx__printk+0x10/0x10 [ 1148.103020][T20042] ? __might_fault+0xb0/0x130 [ 1148.103045][T20042] should_fail_ex+0x414/0x560 [ 1148.103079][T20042] _copy_from_user+0x2d/0xb0 [ 1148.103103][T20042] ucma_create_id+0xd5/0x360 [ 1148.103127][T20042] ? __pfx_ucma_create_id+0x10/0x10 [ 1148.103162][T20042] ucma_write+0x249/0x2e0 [ 1148.103184][T20042] ? __pfx_ucma_write+0x10/0x10 [ 1148.103200][T20042] ? security_file_permission+0x75/0x290 [ 1148.103224][T20042] ? rw_verify_area+0x255/0x4d0 [ 1148.103241][T20042] ? __lock_acquire+0xab9/0xd20 [ 1148.103261][T20042] ? __pfx_ucma_write+0x10/0x10 [ 1148.103282][T20042] vfs_write+0x27e/0xb30 [ 1148.103308][T20042] ? __pfx_vfs_write+0x10/0x10 [ 1148.103328][T20042] ? __fget_files+0x2a/0x420 [ 1148.103352][T20042] ? __fget_files+0x2a/0x420 [ 1148.103372][T20042] ? __fget_files+0x3a0/0x420 [ 1148.103391][T20042] ? __fget_files+0x2a/0x420 [ 1148.103420][T20042] ksys_write+0x145/0x250 [ 1148.103439][T20042] ? exc_page_fault+0x82/0x100 [ 1148.103458][T20042] ? __pfx_ksys_write+0x10/0x10 [ 1148.103480][T20042] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1148.103500][T20042] ? lockdep_hardirqs_on+0x9c/0x150 [ 1148.103521][T20042] __do_fast_syscall_32+0xb6/0x2b0 [ 1148.103542][T20042] ? lockdep_hardirqs_on+0x9c/0x150 [ 1148.103564][T20042] do_fast_syscall_32+0x34/0x80 [ 1148.103583][T20042] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1148.103604][T20042] RIP: 0023:0xf6ffd539 [ 1148.103621][T20042] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1148.103637][T20042] RSP: 002b:00000000f53ed55c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 1148.103658][T20042] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 1148.103671][T20042] RDX: 0000000000000020 RSI: 0000000000000000 RDI: 0000000000000000 [ 1148.103683][T20042] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1148.103694][T20042] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1148.103706][T20042] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1148.103735][T20042] [ 1148.123994][T20043] ksmbd: Unknown IPC event: 0, ignore. [ 1148.364205][T14572] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 1148.528495][T14572] usb 4-1: Using ep0 maxpacket: 32 [ 1148.545460][T14572] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1148.568514][T14572] usb 4-1: config 0 has no interface number 0 [ 1148.586438][T14572] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1148.598680][T14572] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1148.599766][ T43] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1148.639042][ T43] ath9k_htc: Failed to initialize the device [ 1148.655400][T14572] usb 4-1: Product: syz [ 1148.658358][ T5885] usb 1-1: ath9k_htc: USB layer deinitialized [ 1148.672022][T20049] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3777'. [ 1148.681062][T14572] usb 4-1: Manufacturer: syz [ 1148.698791][T14572] usb 4-1: SerialNumber: syz [ 1148.723588][T14572] usb 4-1: config 0 descriptor?? [ 1148.740623][T14572] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1148.794381][T14572] usb 4-1: selecting invalid altsetting 1 [ 1148.814282][T14572] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1148.866838][T14572] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1148.896820][T14572] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1148.927164][T14572] usb 4-1: media controller created [ 1148.943641][T20038] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1148.957234][T20038] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1149.032387][ T5885] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 1149.035936][T14572] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1149.060933][T20038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3774'. [ 1149.268495][ T5885] usb 1-1: Using ep0 maxpacket: 32 [ 1149.303937][ T5885] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 1149.320351][ T5885] usb 1-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=d2.a2 [ 1149.398058][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1149.414027][ T5885] usb 1-1: Product: syz [ 1149.421082][ T5885] usb 1-1: Manufacturer: syz [ 1149.436539][ T5885] usb 1-1: SerialNumber: syz [ 1149.477144][ T5885] usb 1-1: config 0 descriptor?? [ 1149.478507][ T5907] usb 2-1: new full-speed USB device number 98 using dummy_hcd [ 1149.502869][ T5885] keyspan 1-1:0.0: Keyspan 1 port adapter converter detected [ 1149.518242][ T5885] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 87 [ 1149.538760][ T5885] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 7 [ 1149.658729][ T5885] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 1 [ 1149.661762][ T5907] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1149.666613][ T5885] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 2 [ 1149.906598][ T5907] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1149.923284][ T5885] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 85 [ 1149.931769][ T5907] usb 2-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1149.940993][ T5907] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1149.982034][ T5885] keyspan 1-1:0.0: found no endpoint descriptor for endpoint 5 [ 1149.984988][ T5907] usb 2-1: config 0 descriptor?? [ 1150.033148][ T5885] usb 1-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1150.069093][ T5885] usb 1-1: USB disconnect, device number 116 [ 1150.154326][ T5885] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1150.166384][ T5885] keyspan 1-1:0.0: device disconnected [ 1150.190265][T20064] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3780'. [ 1150.209781][T14572] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1150.234842][T20038] usb 4-1: dvb_usb_ce6230: I2C read not implemented [ 1150.265554][T14572] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1150.449881][T14572] usb 4-1: USB disconnect, device number 121 [ 1150.626668][ T5907] elan 0003:04F3:0755.0051: failed to start in urb: -90 [ 1150.638951][ T5907] elan 0003:04F3:0755.0051: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.1-1/input0 [ 1151.065799][ T5885] usb 2-1: USB disconnect, device number 98 [ 1151.969904][T20082] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3784'. [ 1152.226487][T20095] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1152.238412][ T43] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 1152.421840][ T43] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1152.474064][ T43] usb 2-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1152.552211][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1152.583676][T20107] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3790'. [ 1152.619352][ T43] usb 2-1: config 0 descriptor?? [ 1152.679242][T20113] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3791'. [ 1153.381999][T20118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1153.394796][T20118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1153.427718][T20118] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3786'. [ 1153.662596][T20121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1153.733261][T20121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1153.808422][ T5907] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 1153.962929][ T5907] usb 4-1: Using ep0 maxpacket: 32 [ 1153.982812][ T5907] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 1153.995620][ T5907] usb 4-1: config 0 has no interface number 0 [ 1154.022593][ T5907] usb 4-1: config 0 interface 12 has no altsetting 0 [ 1154.045973][ T5907] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1154.055531][ T5907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1154.070776][T14548] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 1154.072957][ T5907] usb 4-1: Product: syz [ 1154.090833][ T5907] usb 4-1: Manufacturer: syz [ 1154.096881][ T5907] usb 4-1: SerialNumber: syz [ 1154.114512][ T5907] usb 4-1: config 0 descriptor?? [ 1154.279190][T14548] usb 3-1: Using ep0 maxpacket: 32 [ 1154.286773][T14548] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1154.295004][T14548] usb 3-1: config 0 has no interface number 0 [ 1154.304961][T14548] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1154.316006][T14548] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1154.326987][T20122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1154.337388][T14548] usb 3-1: Product: syz [ 1154.342310][T14548] usb 3-1: Manufacturer: syz [ 1154.347091][T20121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1154.356246][T14548] usb 3-1: SerialNumber: syz [ 1154.367857][T14548] usb 3-1: config 0 descriptor?? [ 1154.370381][ T30] kauditd_printk_skb: 34 callbacks suppressed [ 1154.370397][ T30] audit: type=1326 audit(1760348228.505:1987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1154.376760][T20122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1154.394050][ T30] audit: type=1326 audit(1760348228.515:1988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1154.418378][ T5885] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 1154.431654][T20121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1154.612263][T14548] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1154.660072][T14548] usb 3-1: selecting invalid altsetting 1 [ 1154.718564][T14548] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1154.755690][ T30] audit: type=1326 audit(1760348228.525:1989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1154.757978][T14548] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1154.778158][ C0] vkms_vblank_simulate: vblank timer overrun [ 1154.809979][ T30] audit: type=1326 audit(1760348228.525:1990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1154.810062][T14548] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1154.839641][ T30] audit: type=1326 audit(1760348228.525:1991): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1154.862759][ C0] vkms_vblank_simulate: vblank timer overrun [ 1154.869232][T14548] usb 3-1: media controller created [ 1154.877407][T20124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1154.890304][ T5885] usb 1-1: Using ep0 maxpacket: 16 [ 1154.890778][T20124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1154.898222][ T5885] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1154.968766][ T43] usbhid 2-1:0.0: can't add hid device: -71 [ 1154.987198][T20124] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3795'. [ 1154.999084][ T43] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1155.018393][ T5885] usb 1-1: config 0 has no interfaces? [ 1155.048325][ T5885] usb 1-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1155.065523][ T30] audit: type=1326 audit(1760348228.525:1992): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1155.081539][ T43] usb 2-1: USB disconnect, device number 99 [ 1155.208719][ T30] audit: type=1326 audit(1760348228.525:1993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1155.210185][T20121] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1155.270523][T20121] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1155.284315][T14548] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1155.292858][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1155.303587][T20124] usb 3-1: dvb_usb_ce6230: I2C read not implemented [ 1155.355619][ T30] audit: type=1326 audit(1760348228.535:1994): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=226 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1155.377756][ C0] vkms_vblank_simulate: vblank timer overrun [ 1155.385547][ T30] audit: type=1326 audit(1760348228.535:1995): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1155.410526][ T30] audit: type=1326 audit(1760348228.535:1996): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20127 comm="syz.4.3797" exe="/root/syz-executor" sig=0 arch=40000003 syscall=227 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1155.414018][ T5885] usb 1-1: config 0 descriptor?? [ 1155.499714][T14548] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 1155.510922][T14548] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1155.519004][T14548] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1155.603501][T14548] usb 3-1: USB disconnect, device number 99 [ 1155.643389][T20139] FAULT_INJECTION: forcing a failure. [ 1155.643389][T20139] name failslab, interval 1, probability 0, space 0, times 0 [ 1155.657570][T20139] CPU: 0 UID: 0 PID: 20139 Comm: syz.4.3799 Not tainted syzkaller #0 PREEMPT(full) [ 1155.657594][T20139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1155.657605][T20139] Call Trace: [ 1155.657613][T20139] [ 1155.657621][T20139] dump_stack_lvl+0x189/0x250 [ 1155.657646][T20139] ? __pfx____ratelimit+0x10/0x10 [ 1155.657672][T20139] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1155.657691][T20139] ? __pfx__printk+0x10/0x10 [ 1155.657715][T20139] ? __pfx___might_resched+0x10/0x10 [ 1155.657738][T20139] ? fs_reclaim_acquire+0x7d/0x100 [ 1155.657763][T20139] should_fail_ex+0x414/0x560 [ 1155.657794][T20139] should_failslab+0xa8/0x100 [ 1155.657818][T20139] __kmalloc_noprof+0xcb/0x7f0 [ 1155.657836][T20139] ? alloc_pipe_info+0x1fd/0x4d0 [ 1155.657863][T20139] alloc_pipe_info+0x1fd/0x4d0 [ 1155.657886][T20139] splice_direct_to_actor+0xa5d/0xcc0 [ 1155.657923][T20139] ? __pfx_aa_file_perm+0x10/0x10 [ 1155.657944][T20139] ? __lock_acquire+0xab9/0xd20 [ 1155.657966][T20139] ? __pfx_direct_splice_actor+0x10/0x10 [ 1155.658008][T20139] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1155.658039][T20139] do_splice_direct+0x181/0x270 [ 1155.658070][T20139] ? __pfx_do_splice_direct+0x10/0x10 [ 1155.658088][T20139] ? common_file_perm+0x1b5/0x230 [ 1155.658108][T20139] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1155.658132][T20139] ? bpf_lsm_file_permission+0x9/0x20 [ 1155.658154][T20139] ? security_file_permission+0x75/0x290 [ 1155.658181][T20139] ? rw_verify_area+0x255/0x4d0 [ 1155.658204][T20139] do_sendfile+0x4da/0x7e0 [ 1155.658236][T20139] ? __pfx_do_sendfile+0x10/0x10 [ 1155.658259][T20139] ? __pfx_ksys_write+0x10/0x10 [ 1155.658277][T20139] ? __secure_computing+0xe2/0x2a0 [ 1155.658300][T20139] ? __ia32_compat_sys_sendfile+0x180/0x1d0 [ 1155.658326][T20139] __do_fast_syscall_32+0xb6/0x2b0 [ 1155.658345][T20139] ? lockdep_hardirqs_on+0x9c/0x150 [ 1155.658365][T20139] do_fast_syscall_32+0x34/0x80 [ 1155.658383][T20139] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1155.658403][T20139] RIP: 0023:0xf6ffd539 [ 1155.658419][T20139] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1155.658435][T20139] RSP: 002b:00000000f53ed55c EFLAGS: 00000206 ORIG_RAX: 00000000000000bb [ 1155.658454][T20139] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000001 [ 1155.658466][T20139] RDX: 0000000000000000 RSI: 00000000000053d2 RDI: 0000000000000000 [ 1155.658477][T20139] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1155.658488][T20139] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1155.658499][T20139] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1155.658527][T20139] [ 1155.718551][ T43] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 1155.718737][ C0] vkms_vblank_simulate: vblank timer overrun [ 1155.937505][ C0] vkms_vblank_simulate: vblank timer overrun [ 1156.039191][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 1156.043588][ C0] vkms_vblank_simulate: vblank timer overrun [ 1156.068170][ T43] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1156.135907][ T43] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1156.140660][T20144] netlink: 148 bytes leftover after parsing attributes in process `syz.4.3800'. [ 1156.166541][ T43] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1156.196966][T20144] syz.4.3800 (20144): drop_caches: 2 [ 1156.205248][T20144] IPv6: Can't replace route, no match found [ 1156.268031][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1156.282293][ T43] usb 2-1: Product: syz [ 1156.287234][ T43] usb 2-1: Manufacturer: syz [ 1156.297279][ T43] usb 2-1: SerialNumber: syz [ 1156.374526][T20148] netlink: 148 bytes leftover after parsing attributes in process `syz.2.3801'. [ 1156.408119][T20148] syz.2.3801 (20148): drop_caches: 2 [ 1156.424981][T20148] IPv6: Can't replace route, no match found [ 1156.518031][ T43] usb 2-1: 0:2 : does not exist [ 1156.546287][ T43] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 1156.587937][ T43] usb 2-1: USB disconnect, device number 100 [ 1156.686737][T14572] usb 1-1: USB disconnect, device number 117 [ 1157.307591][ T5907] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1157.315234][ T5907] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 1157.356032][ T5907] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1157.428464][ T5907] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 1157.467744][ T5907] usb 4-1: USB disconnect, device number 122 [ 1157.735598][T20159] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3804'. [ 1158.069430][T20171] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3807'. [ 1158.113708][T20167] loop8: detected capacity change from 0 to 8 [ 1158.142127][T20167] Dev loop8: unable to read RDB block 8 [ 1158.155211][T20167] loop8: unable to read partition table [ 1158.166936][T20167] loop8: partition table beyond EOD, truncated [ 1158.229106][T20167] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1158.928589][ T5885] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 1159.138906][ T5885] usb 5-1: Using ep0 maxpacket: 32 [ 1159.147938][ T5885] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1159.156481][ T5885] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1159.167294][ T5885] usb 5-1: config 0 has no interface number 0 [ 1159.173649][ T5885] usb 5-1: config 0 interface 1 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1159.233431][ T5885] usb 5-1: config 0 interface 1 has no altsetting 0 [ 1159.247638][ T5885] usb 5-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 1159.340825][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1159.378869][ T5885] usb 5-1: Product: syz [ 1159.390429][ T5885] usb 5-1: Manufacturer: syz [ 1159.395242][ T5885] usb 5-1: SerialNumber: syz [ 1159.406073][ T5885] usb 5-1: config 0 descriptor?? [ 1159.647274][ T5885] cx231xx 5-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 1159.660331][ T5885] cx231xx 5-1:0.1: Not found matching IAD interface [ 1159.678793][ T5885] usb 5-1: USB disconnect, device number 115 [ 1159.810646][T20196] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1160.548438][ T5885] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 1160.890775][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 1160.890794][ T30] audit: type=1326 audit(1760348234.755:2027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1160.940113][T14548] usb 3-1: new full-speed USB device number 100 using dummy_hcd [ 1160.949023][ T30] audit: type=1326 audit(1760348234.755:2028): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1160.983389][ T5885] usb 5-1: Using ep0 maxpacket: 32 [ 1161.003080][ T30] audit: type=1326 audit(1760348234.755:2029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1161.028839][ T5885] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1161.036889][ T5885] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1161.047315][ T5885] usb 5-1: config 0 has no interface number 0 [ 1161.054015][ T30] audit: type=1326 audit(1760348234.755:2030): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1161.076272][ T5885] usb 5-1: config 0 interface 1 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1161.089592][ T5885] usb 5-1: config 0 interface 1 has no altsetting 0 [ 1161.100325][ T30] audit: type=1326 audit(1760348234.755:2031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1161.124983][ T5885] usb 5-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 1161.136278][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1161.152198][ T5885] usb 5-1: Product: syz [ 1161.156422][ T5885] usb 5-1: Manufacturer: syz [ 1161.163015][ T5885] usb 5-1: SerialNumber: syz [ 1161.168848][ T30] audit: type=1326 audit(1760348234.755:2032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1161.230967][ T30] audit: type=1326 audit(1760348234.755:2033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1161.258830][T20209] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3816'. [ 1161.327608][ T5885] usb 5-1: config 0 descriptor?? [ 1161.334712][T14548] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1161.355128][T20211] IPv6: Can't replace route, no match found [ 1161.376742][T14548] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1161.391342][ T30] audit: type=1326 audit(1760348234.765:2034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=226 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1161.444163][T14548] usb 3-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1161.752021][T20209] syz.0.3816 (20209): drop_caches: 2 [ 1161.786563][ T30] audit: type=1326 audit(1760348234.765:2035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1161.786588][T14548] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1161.875698][T14548] usb 3-1: config 0 descriptor?? [ 1161.914261][ T30] audit: type=1326 audit(1760348234.765:2036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20198 comm="syz.1.3814" exe="/root/syz-executor" sig=0 arch=40000003 syscall=227 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1162.434579][ T5885] cx231xx 5-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 1162.445570][ T5885] cx231xx 5-1:0.1: Not found matching IAD interface [ 1162.485950][ T5885] usb 5-1: USB disconnect, device number 116 [ 1162.711141][T20216] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1162.731333][T14548] usbhid 3-1:0.0: can't add hid device: -71 [ 1162.737349][T14548] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1162.754504][T14548] usb 3-1: USB disconnect, device number 100 [ 1162.761702][T20216] FAULT_INJECTION: forcing a failure. [ 1162.761702][T20216] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1162.777255][T20216] CPU: 1 UID: 0 PID: 20216 Comm: syz.1.3818 Not tainted syzkaller #0 PREEMPT(full) [ 1162.777297][T20216] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1162.777308][T20216] Call Trace: [ 1162.777316][T20216] [ 1162.777325][T20216] dump_stack_lvl+0x189/0x250 [ 1162.777349][T20216] ? __pfx____ratelimit+0x10/0x10 [ 1162.777376][T20216] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1162.777394][T20216] ? __pfx__printk+0x10/0x10 [ 1162.777424][T20216] should_fail_ex+0x414/0x560 [ 1162.777454][T20216] _copy_to_user+0x31/0xb0 [ 1162.777478][T20216] simple_read_from_buffer+0xe1/0x170 [ 1162.777504][T20216] proc_fail_nth_read+0x1b3/0x220 [ 1162.777543][T20216] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1162.777570][T20216] ? rw_verify_area+0x2a6/0x4d0 [ 1162.777587][T20216] ? __lock_acquire+0xab9/0xd20 [ 1162.777607][T20216] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1162.777632][T20216] vfs_read+0x200/0xa30 [ 1162.777649][T20216] ? fdget_pos+0x247/0x320 [ 1162.777675][T20216] ? __pfx___mutex_lock+0x10/0x10 [ 1162.777694][T20216] ? __pfx_vfs_read+0x10/0x10 [ 1162.777715][T20216] ? __fget_files+0x2a/0x420 [ 1162.777738][T20216] ? __fget_files+0x3a0/0x420 [ 1162.777756][T20216] ? __fget_files+0x2a/0x420 [ 1162.777785][T20216] ksys_read+0x145/0x250 [ 1162.777805][T20216] ? __pfx_ksys_read+0x10/0x10 [ 1162.777823][T20216] ? arch_syscall_is_vdso_sigreturn+0x175/0x1a0 [ 1162.777849][T20216] ? syscall_user_dispatch+0x4f/0x90 [ 1162.777878][T20216] __do_fast_syscall_32+0xb6/0x2b0 [ 1162.777898][T20216] ? lockdep_hardirqs_on+0x9c/0x150 [ 1162.777917][T20216] do_fast_syscall_32+0x34/0x80 [ 1162.777935][T20216] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1162.777956][T20216] RIP: 0023:0xf703d539 [ 1162.777972][T20216] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1162.777988][T20216] RSP: 002b:00000000f542d590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1162.778008][T20216] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000f542d620 [ 1162.778022][T20216] RDX: 000000000000000f RSI: 00000000f73d5ff4 RDI: 0000000000000000 [ 1162.778033][T20216] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 1162.778044][T20216] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1162.778056][T20216] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1162.778086][T20216] [ 1163.152464][T20218] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3819'. [ 1163.156720][T20220] program syz.4.3820 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1163.197760][T20220] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3820'. [ 1163.226093][T20218] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1163.238875][T20220] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3820'. [ 1163.282914][T20218] sch_tbf: burst 1821 is lower than device lo mtu (65550) ! [ 1163.340863][T20224] netlink: 'syz.1.3822': attribute type 8 has an invalid length. [ 1163.349062][T20222] netlink: 'syz.1.3822': attribute type 8 has an invalid length. [ 1163.466084][T20231] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1163.498435][T20232] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3823'. [ 1163.758387][T14548] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 1163.848413][ T5907] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 1163.856632][T14572] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 1163.912366][T14548] usb 5-1: New USB device found, idVendor=1b80, idProduct=e396, bcdDevice=a7.b1 [ 1163.921616][ T5885] usb 4-1: new full-speed USB device number 123 using dummy_hcd [ 1163.935242][T14548] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1163.950117][T14548] usb 5-1: Manufacturer: syz [ 1163.961723][T14548] usb 5-1: config 0 descriptor?? [ 1164.008380][ T5907] usb 3-1: Using ep0 maxpacket: 32 [ 1164.015792][ T5907] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1164.026059][T14572] usb 1-1: config 0 interface 0 altsetting 225 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1164.038444][ T5907] usb 3-1: config 0 has no interface number 0 [ 1164.045592][T14572] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1164.053162][T14572] usb 1-1: New USB device found, idVendor=0757, idProduct=0a00, bcdDevice= 0.00 [ 1164.063319][T14572] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1164.072128][ T5907] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1164.081471][ T5907] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1164.089752][ T5907] usb 3-1: Product: syz [ 1164.094443][ T5907] usb 3-1: Manufacturer: syz [ 1164.101347][ T5907] usb 3-1: SerialNumber: syz [ 1164.107840][T14572] usb 1-1: config 0 descriptor?? [ 1164.108619][ T5885] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1164.168365][ T5907] usb 3-1: config 0 descriptor?? [ 1164.184017][ T5885] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1164.194356][T14548] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1164.201758][ T5907] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1164.207818][T14548] dvb_usb_af9015 5-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 1164.221923][ T5907] usb 3-1: selecting invalid altsetting 1 [ 1164.227128][T14548] usb 5-1: USB disconnect, device number 117 [ 1164.235784][ T5885] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 1164.246507][ T5885] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1164.255466][ T5907] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1164.267838][ T5885] usb 4-1: SerialNumber: syz [ 1164.306754][ T5907] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1164.330431][ T5885] usb 4-1: 0:2 : does not exist [ 1164.341619][ T5907] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1164.351662][ T5907] usb 3-1: media controller created [ 1164.408521][T20235] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1164.449221][T20235] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1164.525467][ T5907] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1164.554580][T20235] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3826'. [ 1164.703993][T20248] netlink: 'syz.0.3825': attribute type 1 has an invalid length. [ 1164.752372][T14572] nti 0003:0757:0A00.0052: invalid report_size -1903817399 [ 1164.775608][T14572] nti 0003:0757:0A00.0052: item 0 4 1 7 parsing failed [ 1164.787434][T14572] nti 0003:0757:0A00.0052: probe with driver nti failed with error -22 [ 1164.823785][ T9] usb 4-1: USB disconnect, device number 123 [ 1165.379571][ T9] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 1165.488962][T14572] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 1165.509802][T20257] program syz.3.3833 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1165.572968][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 1165.584105][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1165.595418][T20257] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3833'. [ 1165.607395][T20257] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3833'. [ 1165.616625][ T9] usb 5-1: config 0 has no interfaces? [ 1165.636211][ T9] usb 5-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 1165.645620][ T5907] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1165.654438][T14572] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1165.667832][ T5907] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1165.667854][T20249] usb 3-1: dvb_usb_ce6230: I2C read not implemented [ 1165.682141][T14572] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1165.691295][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1165.706932][T14572] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1165.724280][ T9] usb 5-1: config 0 descriptor?? [ 1165.750893][T14572] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1165.783503][T14572] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1165.804107][T14572] usb 2-1: Product: syz [ 1165.808762][T14572] usb 2-1: Manufacturer: syz [ 1165.813408][T14572] usb 2-1: SerialNumber: syz [ 1165.823557][T14572] cdc_ncm 2-1:1.0: skipping garbage [ 1165.829690][T14572] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 1165.836522][T14572] cdc_ncm 2-1:1.0: bind() failure [ 1165.998952][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 1165.998970][ T30] audit: type=1326 audit(1760348240.105:2053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.036816][ T30] audit: type=1326 audit(1760348240.115:2054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.059368][ T30] audit: type=1326 audit(1760348240.115:2055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.086025][ T30] audit: type=1326 audit(1760348240.115:2056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.109481][ T30] audit: type=1326 audit(1760348240.115:2057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.132053][ T30] audit: type=1326 audit(1760348240.115:2058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.163991][ T30] audit: type=1326 audit(1760348240.115:2059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.188188][ T30] audit: type=1326 audit(1760348240.115:2060): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.214428][ T30] audit: type=1326 audit(1760348240.115:2061): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=226 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.246050][ T30] audit: type=1326 audit(1760348240.115:2062): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20259 comm="syz.3.3834" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700d539 code=0x7ffc0000 [ 1166.547003][ T5885] usb 5-1: USB disconnect, device number 118 [ 1166.847594][ T5907] usb 3-1: USB disconnect, device number 101 [ 1166.883601][T14549] usb 1-1: USB disconnect, device number 118 [ 1166.958427][T14548] usb 4-1: new full-speed USB device number 124 using dummy_hcd [ 1166.969020][ T5885] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 1166.979471][T20272] FAULT_INJECTION: forcing a failure. [ 1166.979471][T20272] name failslab, interval 1, probability 0, space 0, times 0 [ 1166.992404][T20272] CPU: 1 UID: 0 PID: 20272 Comm: syz.2.3837 Not tainted syzkaller #0 PREEMPT(full) [ 1166.992430][T20272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1166.992440][T20272] Call Trace: [ 1166.992447][T20272] [ 1166.992452][T20272] dump_stack_lvl+0x189/0x250 [ 1166.992469][T20272] ? __pfx____ratelimit+0x10/0x10 [ 1166.992484][T20272] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1166.992495][T20272] ? __pfx__printk+0x10/0x10 [ 1166.992508][T20272] ? __pfx___might_resched+0x10/0x10 [ 1166.992521][T20272] ? fs_reclaim_acquire+0x7d/0x100 [ 1166.992536][T20272] should_fail_ex+0x414/0x560 [ 1166.992553][T20272] should_failslab+0xa8/0x100 [ 1166.992567][T20272] kmem_cache_alloc_node_noprof+0x77/0x710 [ 1166.992578][T20272] ? __alloc_skb+0x112/0x2d0 [ 1166.992595][T20272] __alloc_skb+0x112/0x2d0 [ 1166.992610][T20272] netlink_sendmsg+0x5c6/0xb30 [ 1166.992629][T20272] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1166.992643][T20272] ? __import_iovec+0x5d4/0x7f0 [ 1166.992655][T20272] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1166.992668][T20272] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1166.992680][T20272] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1166.992694][T20272] __sock_sendmsg+0x21c/0x270 [ 1166.992707][T20272] ____sys_sendmsg+0x505/0x830 [ 1166.992725][T20272] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1166.992747][T20272] ___sys_sendmsg+0x21f/0x2a0 [ 1166.992757][T20272] ? __pfx____sys_sendmsg+0x10/0x10 [ 1166.992789][T20272] ? __fget_files+0x2a/0x420 [ 1166.992801][T20272] ? __fget_files+0x3a0/0x420 [ 1166.992817][T20272] __sys_sendmsg+0x164/0x220 [ 1166.992832][T20272] ? __pfx___sys_sendmsg+0x10/0x10 [ 1166.992851][T20272] ? __pfx_ksys_write+0x10/0x10 [ 1166.992863][T20272] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1166.992875][T20272] ? lockdep_hardirqs_on+0x9c/0x150 [ 1166.992886][T20272] __do_fast_syscall_32+0xb6/0x2b0 [ 1166.992898][T20272] ? lockdep_hardirqs_on+0x9c/0x150 [ 1166.992909][T20272] do_fast_syscall_32+0x34/0x80 [ 1166.992920][T20272] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1166.992940][T20272] RIP: 0023:0xf7fd2539 [ 1166.992950][T20272] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1166.992959][T20272] RSP: 002b:00000000f54c655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1166.992971][T20272] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080006040 [ 1166.992978][T20272] RDX: 0000000020001880 RSI: 0000000000000000 RDI: 0000000000000000 [ 1166.992985][T20272] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1166.992991][T20272] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1166.992997][T20272] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1166.993011][T20272] [ 1167.352540][T14548] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1167.365892][T14548] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1167.366331][T20277] loop8: detected capacity change from 0 to 8 [ 1167.375898][T14548] usb 4-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1167.391917][T14548] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1167.402337][T14548] usb 4-1: config 0 descriptor?? [ 1167.420078][ T5885] usb 5-1: config 0 has no interfaces? [ 1167.422616][ T6020] Dev loop8: unable to read RDB block 8 [ 1167.432512][ T6020] loop8: unable to read partition table [ 1167.434579][ T5885] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1167.438933][ T6020] loop8: partition table beyond EOD, [ 1167.447430][ T5885] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1167.447571][ T6020] truncated [ 1167.452942][ T5885] usb 5-1: Product: syz [ 1167.452959][ T5885] usb 5-1: Manufacturer: syz [ 1167.452975][ T5885] usb 5-1: SerialNumber: syz [ 1167.480710][ T5885] usb 5-1: config 0 descriptor?? [ 1167.481956][T20277] Dev loop8: unable to read RDB block 8 [ 1167.496048][T20277] loop8: unable to read partition table [ 1167.503436][T20277] loop8: partition table beyond EOD, truncated [ 1167.510451][T20277] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1167.538682][T14549] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 1167.688338][T14549] usb 1-1: Using ep0 maxpacket: 8 [ 1167.695391][T14549] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1167.704164][T14549] usb 1-1: config 0 has no interface number 0 [ 1167.710754][T14549] usb 1-1: config 0 interface 1 has no altsetting 0 [ 1167.721745][T14549] usb 1-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=70.2f [ 1167.732286][T14549] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1167.740662][T14549] usb 1-1: Product: syz [ 1167.745151][T14549] usb 1-1: Manufacturer: syz [ 1167.749926][T14549] usb 1-1: SerialNumber: syz [ 1167.757811][T14549] usb 1-1: config 0 descriptor?? [ 1167.858705][ T5907] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 1167.883410][T14548] usbhid 4-1:0.0: can't add hid device: -71 [ 1167.889728][T14548] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1167.902053][T14548] usb 4-1: USB disconnect, device number 124 [ 1168.008391][ T5907] usb 3-1: Using ep0 maxpacket: 8 [ 1168.015481][ T5907] usb 3-1: config index 0 descriptor too short (expected 49041, got 36) [ 1168.024223][ T5907] usb 3-1: config 97 has too many interfaces: 232, using maximum allowed: 32 [ 1168.033258][ T5907] usb 3-1: config 97 has an invalid descriptor of length 248, skipping remainder of the config [ 1168.043965][ T5907] usb 3-1: config 97 has 0 interfaces, different from the descriptor's value: 232 [ 1168.053449][ T5907] usb 3-1: New USB device found, idVendor=1e71, idProduct=170e, bcdDevice= 0.00 [ 1168.064255][ T5907] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1168.272665][ T9] usb 2-1: USB disconnect, device number 101 [ 1168.603275][T20290] netlink: 1272 bytes leftover after parsing attributes in process `syz.1.3841'. [ 1169.626405][ T5885] usb 5-1: USB disconnect, device number 119 [ 1169.998879][T14549] i2c-cp2615 1-1:0.1: probe with driver i2c-cp2615 failed with error -71 [ 1170.020789][T14549] usb 1-1: USB disconnect, device number 119 [ 1170.305027][T20304] program syz.4.3844 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1170.367022][T20304] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3844'. [ 1170.376639][T20304] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3844'. [ 1170.771553][T20300] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1170.813257][T20300] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1170.827403][T20307] FAULT_INJECTION: forcing a failure. [ 1170.827403][T20307] name failslab, interval 1, probability 0, space 0, times 0 [ 1170.888797][T20307] CPU: 0 UID: 0 PID: 20307 Comm: syz.4.3847 Not tainted syzkaller #0 PREEMPT(full) [ 1170.888823][T20307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1170.888833][T20307] Call Trace: [ 1170.888841][T20307] [ 1170.888849][T20307] dump_stack_lvl+0x189/0x250 [ 1170.888875][T20307] ? __pfx____ratelimit+0x10/0x10 [ 1170.888902][T20307] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1170.888924][T20307] ? __pfx__printk+0x10/0x10 [ 1170.888948][T20307] ? __pfx___might_resched+0x10/0x10 [ 1170.888971][T20307] ? fs_reclaim_acquire+0x7d/0x100 [ 1170.888997][T20307] should_fail_ex+0x414/0x560 [ 1170.889029][T20307] should_failslab+0xa8/0x100 [ 1170.889053][T20307] __kmalloc_noprof+0xcb/0x7f0 [ 1170.889073][T20307] ? tomoyo_encode+0x28b/0x550 [ 1170.889100][T20307] tomoyo_encode+0x28b/0x550 [ 1170.889124][T20307] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1170.889157][T20307] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1170.889182][T20307] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1170.889210][T20307] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1170.889255][T20307] ? __lock_acquire+0xab9/0xd20 [ 1170.889295][T20307] ? __fget_files+0x2a/0x420 [ 1170.889319][T20307] ? __fget_files+0x3a0/0x420 [ 1170.889339][T20307] ? __fget_files+0x2a/0x420 [ 1170.889363][T20307] security_file_ioctl_compat+0xcb/0x2d0 [ 1170.889390][T20307] __ia32_compat_sys_ioctl+0x128/0x840 [ 1170.889412][T20307] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1170.889430][T20307] ? __fget_files+0x3a0/0x420 [ 1170.889466][T20307] ? fput+0xa0/0xd0 [ 1170.889489][T20307] ? ksys_write+0x22a/0x250 [ 1170.889506][T20307] ? exc_page_fault+0x82/0x100 [ 1170.889530][T20307] ? __pfx_ksys_write+0x10/0x10 [ 1170.889551][T20307] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1170.889571][T20307] ? lockdep_hardirqs_on+0x9c/0x150 [ 1170.889592][T20307] __do_fast_syscall_32+0xb6/0x2b0 [ 1170.889613][T20307] ? lockdep_hardirqs_on+0x9c/0x150 [ 1170.889635][T20307] do_fast_syscall_32+0x34/0x80 [ 1170.889652][T20307] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1170.889673][T20307] RIP: 0023:0xf6ffd539 [ 1170.889688][T20307] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1170.889702][T20307] RSP: 002b:00000000f53ed55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1170.889722][T20307] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c04064a0 [ 1170.889734][T20307] RDX: 0000000080000a40 RSI: 0000000000000000 RDI: 0000000000000000 [ 1170.889745][T20307] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1170.889756][T20307] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1170.889766][T20307] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1170.889795][T20307] [ 1170.891168][T20307] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1171.547624][ T5907] usb 3-1: string descriptor 0 read error: -71 [ 1171.560109][ T5907] usb 3-1: USB disconnect, device number 102 [ 1171.619559][ T9] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 1171.668090][T20300] gtp0: left promiscuous mode [ 1171.694349][ T66] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1171.704092][ T66] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1171.732148][ T66] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1171.764477][ T66] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1171.778375][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 1171.806631][ T9] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1171.825865][ T9] usb 4-1: config 0 has no interface number 0 [ 1171.859081][ T9] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1171.891070][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1171.923312][ T9] usb 4-1: Product: syz [ 1171.931943][ T9] usb 4-1: Manufacturer: syz [ 1171.936816][ T9] usb 4-1: SerialNumber: syz [ 1171.947504][ T9] usb 4-1: config 0 descriptor?? [ 1171.956459][ T9] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1171.966979][ T9] usb 4-1: selecting invalid altsetting 1 [ 1171.973428][ T9] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1171.994083][ T9] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1172.128141][ T9] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1172.136989][ T9] usb 4-1: media controller created [ 1172.178717][ T5907] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 1172.218123][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1172.243401][T20309] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1172.258474][T20309] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1172.292295][T20309] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3848'. [ 1172.371307][ T5907] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1172.385237][ T5907] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1172.395530][ T5907] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1172.415682][ T5907] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1172.427734][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1172.456919][ T5907] usb 2-1: Product: syz [ 1172.462210][ T5907] usb 2-1: Manufacturer: syz [ 1172.467257][ T5907] usb 2-1: SerialNumber: syz [ 1172.524392][T20331] netlink: 148 bytes leftover after parsing attributes in process `syz.4.3853'. [ 1172.570041][ T5907] cdc_ncm 2-1:1.0: skipping garbage [ 1172.598204][ T5907] cdc_ncm 2-1:1.0: CDC Union missing and no IAD found [ 1172.625686][ T5907] cdc_ncm 2-1:1.0: bind() failure [ 1172.632230][T20333] IPv6: Can't replace route, no match found [ 1172.987044][T20331] syz.4.3853 (20331): drop_caches: 2 [ 1173.433839][ T9] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1173.441151][ T9] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1173.448543][T20309] usb 4-1: dvb_usb_ce6230: I2C read not implemented [ 1174.169278][T20347] program syz.2.3857 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1174.193312][T20347] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3857'. [ 1174.202603][T20347] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3857'. [ 1174.278468][ T30] kauditd_printk_skb: 39 callbacks suppressed [ 1174.278487][ T30] audit: type=1326 audit(1760348248.405:2102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.366120][ T30] audit: type=1326 audit(1760348248.415:2103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.511660][ T30] audit: type=1326 audit(1760348248.415:2104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.556375][ T30] audit: type=1326 audit(1760348248.415:2105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.581162][ T30] audit: type=1326 audit(1760348248.415:2106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.605579][ T30] audit: type=1326 audit(1760348248.415:2107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.629421][ T30] audit: type=1326 audit(1760348248.415:2108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=226 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.652283][ T30] audit: type=1326 audit(1760348248.415:2109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.675250][ C0] vkms_vblank_simulate: vblank timer overrun [ 1174.688459][ T30] audit: type=1326 audit(1760348248.415:2110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=227 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.808336][ T9] usb 4-1: USB disconnect, device number 125 [ 1174.828699][ T30] audit: type=1326 audit(1760348248.415:2111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20348 comm="syz.0.3858" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ad539 code=0x7ffc0000 [ 1174.895288][ T5885] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 1175.108436][ T5885] usb 3-1: Using ep0 maxpacket: 32 [ 1175.124638][ T5885] usb 3-1: config 0 has no interfaces? [ 1175.143960][ T5885] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1175.155153][ T5885] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1175.186861][ T5885] usb 3-1: Product: syz [ 1175.198966][ T5885] usb 3-1: Manufacturer: syz [ 1175.209161][ T5885] usb 3-1: SerialNumber: syz [ 1175.236877][ T5885] usb 3-1: config 0 descriptor?? [ 1175.364278][ T9] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 1175.382318][T20379] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3864'. [ 1175.469887][T20357] FAULT_INJECTION: forcing a failure. [ 1175.469887][T20357] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1175.486830][T20357] CPU: 1 UID: 0 PID: 20357 Comm: syz.2.3859 Not tainted syzkaller #0 PREEMPT(full) [ 1175.486857][T20357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1175.486869][T20357] Call Trace: [ 1175.486878][T20357] [ 1175.486888][T20357] dump_stack_lvl+0x189/0x250 [ 1175.486914][T20357] ? __pfx____ratelimit+0x10/0x10 [ 1175.486941][T20357] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1175.486961][T20357] ? __pfx__printk+0x10/0x10 [ 1175.486989][T20357] ? __might_fault+0xb0/0x130 [ 1175.487021][T20357] should_fail_ex+0x414/0x560 [ 1175.487052][T20357] _copy_from_user+0x2d/0xb0 [ 1175.487077][T20357] get_compat_msghdr+0xad/0x4a0 [ 1175.487108][T20357] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1175.487139][T20357] ___sys_recvmsg+0x17f/0x510 [ 1175.487157][T20357] ? __pfx____sys_recvmsg+0x10/0x10 [ 1175.487196][T20357] ? __fget_files+0x3a0/0x420 [ 1175.487227][T20357] do_recvmmsg+0x36a/0x770 [ 1175.487255][T20357] ? __pfx_do_recvmmsg+0x10/0x10 [ 1175.487273][T20357] ? ksys_write+0x1cb/0x250 [ 1175.487311][T20357] ? __fget_files+0x3a0/0x420 [ 1175.487340][T20357] __sys_recvmmsg+0x19d/0x280 [ 1175.487362][T20357] ? __pfx___sys_recvmmsg+0x10/0x10 [ 1175.487381][T20357] ? __pfx_ksys_write+0x10/0x10 [ 1175.487406][T20357] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 1175.487437][T20357] __do_fast_syscall_32+0xb6/0x2b0 [ 1175.487465][T20357] do_fast_syscall_32+0x34/0x80 [ 1175.487484][T20357] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1175.487506][T20357] RIP: 0023:0xf7fd2539 [ 1175.487523][T20357] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1175.487539][T20357] RSP: 002b:00000000f54c655c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 1175.487560][T20357] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080006ec0 [ 1175.487573][T20357] RDX: 0000000000000001 RSI: 0000000000000a00 RDI: 0000000000000000 [ 1175.487584][T20357] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1175.487595][T20357] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1175.487606][T20357] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1175.487635][T20357] [ 1175.588408][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 1175.798442][ T5907] usb 2-1: USB disconnect, device number 102 [ 1175.811058][ T9] usb 4-1: config 0 has no interfaces? [ 1175.832254][ T9] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1175.851442][T20382] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3865'. [ 1175.883642][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1175.893712][ T9] usb 4-1: Product: syz [ 1175.901482][ T9] usb 4-1: Manufacturer: syz [ 1175.919027][ T9] usb 4-1: SerialNumber: syz [ 1175.948221][ T9] usb 4-1: config 0 descriptor?? [ 1176.129788][T20387] loop8: detected capacity change from 0 to 8 [ 1176.147413][ T6020] Dev loop8: unable to read RDB block 8 [ 1176.157846][ T6020] loop8: unable to read partition table [ 1176.182110][ T6020] loop8: partition table beyond EOD, truncated [ 1176.193471][T20387] Dev loop8: unable to read RDB block 8 [ 1176.209292][T20387] loop8: unable to read partition table [ 1176.215814][T20387] loop8: partition table beyond EOD, truncated [ 1176.222275][T20387] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1176.355153][T20392] loop8: detected capacity change from 0 to 8 [ 1176.363951][ T6020] Dev loop8: unable to read RDB block 8 [ 1176.370619][ T6020] loop8: unable to read partition table [ 1176.377274][ T6020] loop8: partition table beyond EOD, truncated [ 1176.407035][T20392] Dev loop8: unable to read RDB block 8 [ 1176.429258][T20392] loop8: unable to read partition table [ 1176.438617][T20392] loop8: partition table beyond EOD, truncated [ 1176.454347][T20392] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 1176.870907][T20400] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3871'. [ 1177.118479][ T5885] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 1177.258647][ T5885] usb 1-1: device descriptor read/64, error -71 [ 1177.314293][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.321194][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.347355][T20402] ebtables: wrong size: *len 264, entries_size 144, replsz 144 [ 1177.430023][ T9] usb 3-1: USB disconnect, device number 103 [ 1177.498873][ T5885] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 1177.688487][ T5885] usb 1-1: device descriptor read/64, error -71 [ 1177.713070][T20414] netlink: 'syz.1.3876': attribute type 13 has an invalid length. [ 1177.881999][ T5885] usb usb1-port1: attempt power cycle [ 1177.928044][ T9] usb 4-1: USB disconnect, device number 126 [ 1177.958171][T20421] netlink: 1272 bytes leftover after parsing attributes in process `syz.2.3875'. [ 1178.230329][T20414] 8021q: adding VLAN 0 to HW filter on device  [ 1178.309515][T20414] 8021q: adding VLAN 0 to HW filter on device team0 [ 1178.356599][T20414] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1178.687496][ T5885] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 1178.759144][ T5885] usb 1-1: device descriptor read/8, error -71 [ 1178.870812][T20425] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3877'. [ 1179.000895][ T5885] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 1179.030526][ T9] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 1179.048577][ T5885] usb 1-1: device descriptor read/8, error -71 [ 1179.189602][ T5885] usb usb1-port1: unable to enumerate USB device [ 1179.418586][ T9] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 1179.588378][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 1179.598430][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1179.609468][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1179.624078][ T9] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1179.638354][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1179.651515][ T9] usb 5-1: Product: syz [ 1179.657581][ T9] usb 5-1: Manufacturer: syz [ 1179.670472][ T9] usb 5-1: SerialNumber: syz [ 1179.879240][ T5907] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 1179.894379][ T9] usb 5-1: 0:2 : does not exist [ 1179.900349][T20453] netlink: 1284 bytes leftover after parsing attributes in process `syz.1.3885'. [ 1179.905153][ T9] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 1179.935788][T20453] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3885'. [ 1180.378616][ T9] usb 5-1: USB disconnect, device number 120 [ 1180.656416][ T6020] udevd[6020]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1181.202797][T20472] FAULT_INJECTION: forcing a failure. [ 1181.202797][T20472] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1181.216313][T20472] CPU: 1 UID: 0 PID: 20472 Comm: syz.4.3890 Not tainted syzkaller #0 PREEMPT(full) [ 1181.216329][T20472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1181.216336][T20472] Call Trace: [ 1181.216343][T20472] [ 1181.216348][T20472] dump_stack_lvl+0x189/0x250 [ 1181.216365][T20472] ? __pfx____ratelimit+0x10/0x10 [ 1181.216380][T20472] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1181.216391][T20472] ? __pfx__printk+0x10/0x10 [ 1181.216402][T20472] ? __might_fault+0xb0/0x130 [ 1181.216418][T20472] should_fail_ex+0x414/0x560 [ 1181.216436][T20472] strncpy_from_user+0x36/0x290 [ 1181.216452][T20472] getname_flags+0xf3/0x540 [ 1181.216465][T20472] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1181.216486][T20472] __ia32_sys_mkdir+0x5d/0x80 [ 1181.216497][T20472] __do_fast_syscall_32+0xb6/0x2b0 [ 1181.216509][T20472] ? lockdep_hardirqs_on+0x9c/0x150 [ 1181.216521][T20472] do_fast_syscall_32+0x34/0x80 [ 1181.216531][T20472] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1181.216544][T20472] RIP: 0023:0xf6ffd539 [ 1181.216554][T20472] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1181.216563][T20472] RSP: 002b:00000000f53cc55c EFLAGS: 00000206 ORIG_RAX: 0000000000000027 [ 1181.216575][T20472] RAX: ffffffffffffffda RBX: 0000000080000180 RCX: 0000000000000000 [ 1181.216582][T20472] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1181.216588][T20472] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1181.216594][T20472] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1181.216600][T20472] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1181.216615][T20472] [ 1181.674277][T20475] veth0_vlan: left promiscuous mode [ 1181.681596][T20475] veth0_vlan: entered promiscuous mode [ 1181.748433][T20475] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3891'. [ 1181.795063][T20482] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3892'. [ 1181.821298][T20481] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1182.138485][T14549] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 1182.158471][ T9] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 1182.298877][ T9] usb 2-1: device descriptor read/64, error -71 [ 1182.305382][T14549] usb 1-1: Using ep0 maxpacket: 32 [ 1182.313142][T14549] usb 1-1: config 0 has an invalid interface number: 132 but max is 0 [ 1182.322448][T14549] usb 1-1: config 0 has no interface number 0 [ 1182.329001][T14549] usb 1-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1182.341016][T14549] usb 1-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1182.351725][T14549] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1182.362053][T14549] usb 1-1: Product: syz [ 1182.366437][T14549] usb 1-1: Manufacturer: syz [ 1182.371520][T14549] usb 1-1: SerialNumber: syz [ 1182.378717][T14549] usb 1-1: config 0 descriptor?? [ 1182.387018][T14549] em28xx 1-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1182.397513][T14549] em28xx 1-1:0.132: Video interface 132 found: [ 1182.469239][ T5907] usb 3-1: new low-speed USB device number 104 using dummy_hcd [ 1182.538533][ T9] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 1182.548855][T14572] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 1182.634214][ T5907] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1182.644038][ T5907] usb 3-1: config 1 has an invalid interface number: 181 but max is 0 [ 1182.655035][ T5907] usb 3-1: config 1 has no interface number 0 [ 1182.661426][ T5907] usb 3-1: config 1 interface 181 altsetting 1 endpoint 0xE has invalid maxpacket 64, setting to 8 [ 1182.672296][ T9] usb 2-1: device descriptor read/64, error -71 [ 1182.678689][ T5907] usb 3-1: config 1 interface 181 has no altsetting 0 [ 1182.689254][ T5907] usb 3-1: string descriptor 0 read error: -22 [ 1182.695670][ T5907] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=1d.74 [ 1182.704812][T14572] usb 4-1: Using ep0 maxpacket: 8 [ 1182.710118][ T5907] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1182.719958][T14572] usb 4-1: config index 0 descriptor too short (expected 49041, got 36) [ 1182.729375][T14572] usb 4-1: config 97 has too many interfaces: 232, using maximum allowed: 32 [ 1182.741359][T14572] usb 4-1: config 97 has an invalid descriptor of length 248, skipping remainder of the config [ 1182.756134][T14572] usb 4-1: config 97 has 0 interfaces, different from the descriptor's value: 232 [ 1182.767068][T14572] usb 4-1: New USB device found, idVendor=1e71, idProduct=170e, bcdDevice= 0.00 [ 1182.777142][ T5907] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1182.786825][T14572] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1182.788872][T14549] em28xx 1-1:0.132: unknown em28xx chip ID (0) [ 1182.799755][ T9] usb usb2-port1: attempt power cycle [ 1182.868421][ T10] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 1183.023036][ T10] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1183.032621][ T10] usb 5-1: config 13 has an invalid interface number: 2 but max is 0 [ 1183.040947][ T10] usb 5-1: config 13 has no interface number 0 [ 1183.047467][ T10] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x2 has invalid maxpacket 17704, setting to 1024 [ 1183.058981][ T10] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x4 has an invalid bInterval 0, changing to 7 [ 1183.070303][ T10] usb 5-1: config 13 interface 2 altsetting 5 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1183.080296][ T10] usb 5-1: config 13 interface 2 has no altsetting 0 [ 1183.177256][ T10] usb 5-1: New USB device found, idVendor=05ac, idProduct=022a, bcdDevice=57.1b [ 1183.187141][ T10] usb 5-1: New USB device strings: Mfr=1, Product=245, SerialNumber=2 [ 1183.198066][ T10] usb 5-1: Product: syz [ 1183.205447][ T10] usb 5-1: Manufacturer: syz [ 1183.210283][ T10] usb 5-1: SerialNumber: syz [ 1183.220695][T14549] em28xx 1-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 1183.274889][T14549] em28xx 1-1:0.132: board has no eeprom [ 1183.275744][ T9] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 1183.291343][T20495] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1183.339326][ T9] usb 2-1: device descriptor read/8, error -71 [ 1183.378404][T14549] em28xx 1-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1183.386500][T14549] em28xx 1-1:0.132: analog set to bulk mode. [ 1183.392947][ T5885] em28xx 1-1:0.132: Registering V4L2 extension [ 1183.515054][T14549] usb 1-1: USB disconnect, device number 124 [ 1183.521512][ T5885] em28xx 1-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 1183.541902][T14549] em28xx 1-1:0.132: Disconnecting em28xx [ 1183.590180][ T10] appletouch 5-1:13.2: Could not find int-in endpoint [ 1183.599858][ T9] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 1183.634215][ T10] appletouch 5-1:13.2: probe with driver appletouch failed with error -5 [ 1183.659228][ T9] usb 2-1: device descriptor read/8, error -71 [ 1183.667489][ T10] usbhid 5-1:13.2: couldn't find an input interrupt endpoint [ 1183.710457][ T10] usb 5-1: USB disconnect, device number 121 [ 1183.767067][ T5885] em28xx 1-1:0.132: Config register raw data: 0xffffffed [ 1183.775269][ T5885] em28xx 1-1:0.132: AC97 chip type couldn't be determined [ 1183.783364][ T5885] em28xx 1-1:0.132: No AC97 audio processor [ 1183.789639][ T9] usb usb2-port1: unable to enumerate USB device [ 1183.800699][ T12] usb 3-1: Failed to submit usb control message: -110 [ 1183.808480][ T12] usb 3-1: unable to send the bmi data to the device: -110 [ 1183.823369][ T12] usb 3-1: unable to get target info from device [ 1183.825063][ T5885] usb 1-1: Decoder not found [ 1183.839282][ T12] usb 3-1: could not get target info (-110) [ 1183.848502][ T5885] em28xx 1-1:0.132: failed to create media graph [ 1183.858610][ T12] usb 3-1: could not probe fw (-110) [ 1183.865608][ T5885] em28xx 1-1:0.132: V4L2 device video103 deregistered [ 1183.911162][ T30] kauditd_printk_skb: 74 callbacks suppressed [ 1183.911182][ T30] audit: type=1326 audit(1760348258.015:2186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1183.984551][ T30] audit: type=1326 audit(1760348258.025:2187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1184.020947][ T5885] em28xx 1-1:0.132: Remote control support is not available for this card. [ 1184.030915][T14549] em28xx 1-1:0.132: Closing input extension [ 1184.037041][T14549] ================================================================== [ 1184.045263][T14549] BUG: KASAN: slab-use-after-free in media_device_unregister+0x141/0x400 [ 1184.053749][T14549] Read of size 8 at addr ffff888058e7c210 by task kworker/1:9/14549 [ 1184.062042][T14549] [ 1184.064376][T14549] CPU: 1 UID: 0 PID: 14549 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) [ 1184.064397][T14549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1184.064409][T14549] Workqueue: usb_hub_wq hub_event [ 1184.064429][T14549] Call Trace: [ 1184.064440][T14549] [ 1184.064448][T14549] dump_stack_lvl+0x189/0x250 [ 1184.064469][T14549] ? rcu_is_watching+0x15/0xb0 [ 1184.064497][T14549] ? __kasan_check_byte+0x12/0x40 [ 1184.064515][T14549] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1184.064528][T14549] ? rcu_is_watching+0x15/0xb0 [ 1184.064547][T14549] ? lock_release+0x4b/0x3e0 [ 1184.064567][T14549] ? __virt_addr_valid+0x1c8/0x5c0 [ 1184.064583][T14549] ? __virt_addr_valid+0x4a5/0x5c0 [ 1184.064598][T14549] print_report+0xca/0x240 [ 1184.064620][T14549] ? media_device_unregister+0x141/0x400 [ 1184.064636][T14549] kasan_report+0x118/0x150 [ 1184.064654][T14549] ? media_device_unregister+0x141/0x400 [ 1184.064672][T14549] media_device_unregister+0x141/0x400 [ 1184.064691][T14549] em28xx_release_resources+0xac/0x240 [ 1184.064712][T14549] em28xx_usb_disconnect+0x19f/0x2f0 [ 1184.064730][T14549] usb_unbind_interface+0x26e/0x910 [ 1184.064753][T14549] ? __pfx_usb_unbind_interface+0x10/0x10 [ 1184.064767][T14549] device_release_driver_internal+0x4d9/0x800 [ 1184.064789][T14549] bus_remove_device+0x34d/0x410 [ 1184.064805][T14549] device_del+0x511/0x8e0 [ 1184.064824][T14549] ? __pfx_device_del+0x10/0x10 [ 1184.064839][T14549] ? kobject_put+0x446/0x480 [ 1184.064857][T14549] usb_disable_device+0x3e9/0x8a0 [ 1184.064884][T14549] usb_disconnect+0x330/0x950 [ 1184.064906][T14549] hub_event+0x1cf5/0x4a20 [ 1184.064919][T14549] ? cpuacct_charge+0x117/0x320 [ 1184.064946][T14549] ? do_raw_spin_lock+0x121/0x290 [ 1184.064962][T14549] ? register_lock_class+0x51/0x320 [ 1184.064983][T14549] ? __pfx_hub_event+0x10/0x10 [ 1184.064995][T14549] ? process_scheduled_works+0x9ef/0x17b0 [ 1184.065019][T14549] ? _raw_spin_unlock_irq+0x23/0x50 [ 1184.065041][T14549] ? process_scheduled_works+0x9ef/0x17b0 [ 1184.065058][T14549] ? process_scheduled_works+0x9ef/0x17b0 [ 1184.065077][T14549] process_scheduled_works+0xae1/0x17b0 [ 1184.065104][T14549] ? __pfx_process_scheduled_works+0x10/0x10 [ 1184.065137][T14549] worker_thread+0x8a0/0xda0 [ 1184.065161][T14549] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1184.065185][T14549] ? __kthread_parkme+0x7b/0x200 [ 1184.065208][T14549] kthread+0x711/0x8a0 [ 1184.065223][T14549] ? __pfx_worker_thread+0x10/0x10 [ 1184.065241][T14549] ? __pfx_kthread+0x10/0x10 [ 1184.065255][T14549] ? _raw_spin_unlock_irq+0x23/0x50 [ 1184.065274][T14549] ? lockdep_hardirqs_on+0x9c/0x150 [ 1184.065289][T14549] ? __pfx_kthread+0x10/0x10 [ 1184.065306][T14549] ret_from_fork+0x4bc/0x870 [ 1184.065325][T14549] ? __pfx_ret_from_fork+0x10/0x10 [ 1184.065344][T14549] ? __switch_to_asm+0x39/0x70 [ 1184.065359][T14549] ? __switch_to_asm+0x33/0x70 [ 1184.065382][T14549] ? __pfx_kthread+0x10/0x10 [ 1184.065396][T14549] ret_from_fork_asm+0x1a/0x30 [ 1184.065418][T14549] [ 1184.065425][T14549] [ 1184.365406][T14549] Allocated by task 5885: [ 1184.369812][T14549] kasan_save_track+0x3e/0x80 [ 1184.374492][T14549] __kasan_kmalloc+0x93/0xb0 [ 1184.379210][T14549] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 1184.384692][T14549] em28xx_v4l2_init+0x10b/0x2e70 [ 1184.389632][T14549] em28xx_init_extension+0x120/0x1c0 [ 1184.395116][T14549] process_scheduled_works+0xae1/0x17b0 [ 1184.400745][T14549] worker_thread+0x8a0/0xda0 [ 1184.405440][T14549] kthread+0x711/0x8a0 [ 1184.409588][T14549] ret_from_fork+0x4bc/0x870 [ 1184.414389][T14549] ret_from_fork_asm+0x1a/0x30 [ 1184.419159][T14549] [ 1184.421751][T14549] Freed by task 5885: [ 1184.426306][T14549] kasan_save_track+0x3e/0x80 [ 1184.431155][T14549] __kasan_save_free_info+0x46/0x50 [ 1184.436412][T14549] __kasan_slab_free+0x5c/0x80 [ 1184.441206][T14549] kfree+0x19a/0x6d0 [ 1184.445974][T14549] em28xx_v4l2_init+0x1683/0x2e70 [ 1184.451007][T14549] em28xx_init_extension+0x120/0x1c0 [ 1184.456389][T14549] process_scheduled_works+0xae1/0x17b0 [ 1184.462119][T14549] worker_thread+0x8a0/0xda0 [ 1184.466813][T14549] kthread+0x711/0x8a0 [ 1184.470959][T14549] ret_from_fork+0x4bc/0x870 [ 1184.475731][T14549] ret_from_fork_asm+0x1a/0x30 [ 1184.480491][T14549] [ 1184.482797][T14549] The buggy address belongs to the object at ffff888058e7c000 [ 1184.482797][T14549] which belongs to the cache kmalloc-8k of size 8192 [ 1184.497532][T14549] The buggy address is located 528 bytes inside of [ 1184.497532][T14549] freed 8192-byte region [ffff888058e7c000, ffff888058e7e000) [ 1184.511588][T14549] [ 1184.514023][T14549] The buggy address belongs to the physical page: [ 1184.520518][T14549] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x58e78 [ 1184.529438][T14549] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1184.538204][T14549] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1184.545851][T14549] page_type: f5(slab) [ 1184.549933][T14549] raw: 00fff00000000040 ffff88813ffa7280 dead000000000122 0000000000000000 [ 1184.558524][T14549] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 1184.567110][T14549] head: 00fff00000000040 ffff88813ffa7280 dead000000000122 0000000000000000 [ 1184.575781][T14549] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 1184.584451][T14549] head: 00fff00000000003 ffffea0001639e01 00000000ffffffff 00000000ffffffff [ 1184.593125][T14549] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1184.603267][T14549] page dumped because: kasan: bad access detected [ 1184.610478][T14549] page_owner tracks the page as allocated [ 1184.617370][T14549] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 20451, tgid 20447 (syz.1.3885), ts 1180528437418, free_ts 1180322577569 [ 1184.640256][T14549] post_alloc_hook+0x240/0x2a0 [ 1184.645258][T14549] get_page_from_freelist+0x2365/0x2440 [ 1184.651094][T14549] __alloc_frozen_pages_noprof+0x181/0x370 [ 1184.657427][T14549] alloc_pages_mpol+0x232/0x4a0 [ 1184.662299][T14549] allocate_slab+0x96/0x3a0 [ 1184.666982][T14549] ___slab_alloc+0xe94/0x18a0 [ 1184.671929][T14549] __slab_alloc+0x65/0x100 [ 1184.676561][T14549] __kmalloc_cache_noprof+0x411/0x6f0 [ 1184.682032][T14549] cryptomgr_notify+0x85/0x970 [ 1184.686894][T14549] notifier_call_chain+0x1b6/0x3e0 [ 1184.692005][T14549] blocking_notifier_call_chain+0x6a/0x90 [ 1184.698522][T14549] crypto_alg_mod_lookup+0x3b1/0x5f0 [ 1184.703914][T14549] crypto_alloc_tfm_node+0x13e/0x3f0 [ 1184.709467][T14549] alg_bind+0x2fa/0x570 [ 1184.713623][T14549] __sys_bind+0x2c6/0x3e0 [ 1184.717948][T14549] __ia32_sys_bind+0x7a/0x90 [ 1184.722703][T14549] page last free pid 5197 tgid 5197 stack trace: [ 1184.729018][T14549] __free_frozen_pages+0xbc4/0xd30 [ 1184.734263][T14549] __put_partials+0x146/0x170 [ 1184.738988][T14549] put_cpu_partial+0x1f2/0x2e0 [ 1184.743883][T14549] __slab_free+0x2b9/0x390 [ 1184.748670][T14549] qlist_free_all+0x97/0x140 [ 1184.753611][T14549] kasan_quarantine_reduce+0x148/0x160 [ 1184.759176][T14549] __kasan_slab_alloc+0x22/0x80 [ 1184.764477][T14549] __kmalloc_noprof+0x3c3/0x7f0 [ 1184.769557][T14549] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1184.775401][T14549] tomoyo_path_perm+0x213/0x4b0 [ 1184.780360][T14549] security_inode_getattr+0x12f/0x330 [ 1184.787243][T14549] __x64_sys_newfstat+0xfc/0x200 [ 1184.792979][T14549] do_syscall_64+0xfa/0xfa0 [ 1184.797480][T14549] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1184.804244][T14549] [ 1184.806751][T14549] Memory state around the buggy address: [ 1184.812817][T14549] ffff888058e7c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1184.821408][T14549] ffff888058e7c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1184.830607][T14549] >ffff888058e7c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1184.839211][T14549] ^ [ 1184.843901][T14549] ffff888058e7c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1184.852790][T14549] ffff888058e7c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1184.861648][T14549] ================================================================== [ 1184.870938][ C1] vkms_vblank_simulate: vblank timer overrun [ 1184.901318][ T30] audit: type=1326 audit(1760348258.025:2188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1184.924550][ C1] vkms_vblank_simulate: vblank timer overrun [ 1184.932791][ T30] audit: type=1326 audit(1760348258.025:2189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1184.955922][ C1] vkms_vblank_simulate: vblank timer overrun [ 1184.962925][ T30] audit: type=1326 audit(1760348258.025:2190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=8 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1184.986115][ T30] audit: type=1326 audit(1760348258.035:2191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1185.009874][ C1] vkms_vblank_simulate: vblank timer overrun [ 1185.016755][ T30] audit: type=1326 audit(1760348258.035:2192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=226 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1185.039352][ C1] vkms_vblank_simulate: vblank timer overrun [ 1185.085518][ T30] audit: type=1326 audit(1760348258.035:2193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1185.107749][ C1] vkms_vblank_simulate: vblank timer overrun [ 1185.148448][ T30] audit: type=1326 audit(1760348258.035:2194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=227 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1185.172120][ T30] audit: type=1326 audit(1760348258.035:2195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20507 comm="syz.4.3898" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6ffd539 code=0x7ffc0000 [ 1185.172647][ T10] usb 3-1: USB disconnect, device number 104 [ 1185.194469][ C1] vkms_vblank_simulate: vblank timer overrun [ 1185.391018][T14549] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1185.398371][T14549] CPU: 1 UID: 0 PID: 14549 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) [ 1185.407957][T14549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1185.418291][T14549] Workqueue: usb_hub_wq hub_event [ 1185.423456][T14549] Call Trace: [ 1185.426997][T14549] [ 1185.429947][T14549] dump_stack_lvl+0x99/0x250 [ 1185.434815][T14549] ? __asan_memcpy+0x40/0x70 [ 1185.439498][T14549] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1185.444793][T14549] ? __pfx__printk+0x10/0x10 [ 1185.449593][T14549] vpanic+0x237/0x6d0 [ 1185.453922][T14549] ? __pfx_vpanic+0x10/0x10 [ 1185.458799][T14549] ? preempt_schedule+0xae/0xc0 [ 1185.464314][T14549] ? __pfx_preempt_schedule+0x10/0x10 [ 1185.470363][T14549] panic+0xb9/0xc0 [ 1185.474277][T14549] ? __pfx_panic+0x10/0x10 [ 1185.480410][T14549] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 1185.486402][T14549] ? media_device_unregister+0x141/0x400 [ 1185.492147][T14549] check_panic_on_warn+0x89/0xb0 [ 1185.497604][T14549] ? media_device_unregister+0x141/0x400 [ 1185.503701][T14549] end_report+0x78/0x160 [ 1185.508092][T14549] kasan_report+0x129/0x150 [ 1185.513381][T14549] ? media_device_unregister+0x141/0x400 [ 1185.519846][T14549] media_device_unregister+0x141/0x400 [ 1185.525430][T14549] em28xx_release_resources+0xac/0x240 [ 1185.531590][T14549] em28xx_usb_disconnect+0x19f/0x2f0 [ 1185.538131][T14549] usb_unbind_interface+0x26e/0x910 [ 1185.543954][T14549] ? __pfx_usb_unbind_interface+0x10/0x10 [ 1185.550783][T14549] device_release_driver_internal+0x4d9/0x800 [ 1185.557736][T14549] bus_remove_device+0x34d/0x410 [ 1185.562939][T14549] device_del+0x511/0x8e0 [ 1185.567271][T14549] ? __pfx_device_del+0x10/0x10 [ 1185.572111][T14549] ? kobject_put+0x446/0x480 [ 1185.576772][T14549] usb_disable_device+0x3e9/0x8a0 [ 1185.581865][T14549] usb_disconnect+0x330/0x950 [ 1185.586587][T14549] hub_event+0x1cf5/0x4a20 [ 1185.591025][T14549] ? cpuacct_charge+0x117/0x320 [ 1185.596073][T14549] ? do_raw_spin_lock+0x121/0x290 [ 1185.601201][T14549] ? register_lock_class+0x51/0x320 [ 1185.606413][T14549] ? __pfx_hub_event+0x10/0x10 [ 1185.611425][T14549] ? process_scheduled_works+0x9ef/0x17b0 [ 1185.617676][T14549] ? _raw_spin_unlock_irq+0x23/0x50 [ 1185.623677][T14549] ? process_scheduled_works+0x9ef/0x17b0 [ 1185.630274][T14549] ? process_scheduled_works+0x9ef/0x17b0 [ 1185.636356][T14549] process_scheduled_works+0xae1/0x17b0 [ 1185.642161][T14549] ? __pfx_process_scheduled_works+0x10/0x10 [ 1185.648772][T14549] worker_thread+0x8a0/0xda0 [ 1185.653861][T14549] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1185.660378][T14549] ? __kthread_parkme+0x7b/0x200 [ 1185.665504][T14549] kthread+0x711/0x8a0 [ 1185.670358][T14549] ? __pfx_worker_thread+0x10/0x10 [ 1185.675884][T14549] ? __pfx_kthread+0x10/0x10 [ 1185.680566][T14549] ? _raw_spin_unlock_irq+0x23/0x50 [ 1185.685875][T14549] ? lockdep_hardirqs_on+0x9c/0x150 [ 1185.691191][T14549] ? __pfx_kthread+0x10/0x10 [ 1185.696015][T14549] ret_from_fork+0x4bc/0x870 [ 1185.700804][T14549] ? __pfx_ret_from_fork+0x10/0x10 [ 1185.705940][T14549] ? __switch_to_asm+0x39/0x70 [ 1185.710832][T14549] ? __switch_to_asm+0x33/0x70 [ 1185.716482][T14549] ? __pfx_kthread+0x10/0x10 [ 1185.721825][T14549] ret_from_fork_asm+0x1a/0x30 [ 1185.727217][T14549] [ 1185.730795][T14549] Kernel Offset: disabled [ 1185.735120][T14549] Rebooting in 86400 seconds..