last executing test programs:

8.524631794s ago: executing program 0 (id=3016):
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
r1 = eventfd(0x6)
syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000480)={0x24, &(0x7f0000000180)={0x40, 0x0, 0x4f, {0x4f, 0xf, "5c678a84ebef018ac19db3f25fba9923fd9e3a0bd415c68a6919bffc7efd35e1086f34b85acb2e16e35d2d6f81b2de3d97b7f6e9f892653277c4810d9ed03de8d0d49e01560a1b7fe071d1e126"}}, &(0x7f0000000340)={0x0, 0x3, 0x99, @string={0x99, 0x3, "4918c4ac2ad41d0f57fc47ade59516a89d7f06a6f2bec04b12664ac8f6b421988b0a14b300058d6766addff11aaf1ab68ed533eca0e22d0439da75d9e20d433882b9bfaf7450ef3892036eae9308752aad491c47ee2005bea10a832eccb713d6d158fcef0e3022f8bd41430f86b154c19ab69159044528ca7372575cf9b27e1ba0ac08a315674072cf32e099c8a15a33f2110ab98646d9"}}, &(0x7f0000000400)={0x0, 0x22, 0x1f, {[@main=@item_4={0x3, 0x0, 0xc, "b392aa0c"}, @local=@item_012={0x0, 0x2, 0x1}, @local=@item_012={0x2, 0x2, 0x2, "0de0"}, @local=@item_4={0x3, 0x2, 0x3, "7f51b2b4"}, @global=@item_4={0x3, 0x1, 0x4, "19407c94"}, @main=@item_4={0x3, 0x0, 0xb, "050fb2ea"}, @main=@item_012={0x1, 0x0, 0x9, 'G'}, @global=@item_4={0x3, 0x1, 0x4, "23af0fd5"}]}}, &(0x7f0000000440)={0x0, 0x21, 0x9, {0x9, 0x21, 0xaa2, 0x0, 0x1, {0x22, 0x43f}}}}, &(0x7f0000000700)={0x2c, &(0x7f0000000580)={0x40, 0x17, 0x58, "99cc238282f1298b820f59fbc0ce25c2493ccc201284a7656c78d52977826a6f6bf3db0b404908dd344228358073b35c9968196e40acb33eb8c2a30e807d4b74ad58c1141909005c6f1547f113ad1046645a39a12c17ffec"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000680)={0x20, 0x1, 0x32, "70549da55d9baeba6976ba9e52c9d6bb8ef2aaa86561c7d90cfd84d4f23e0f75cf37e37827310cbd2e835b095acb2788a398"}, &(0x7f00000006c0)={0x20, 0x3, 0x1, 0x9}})
ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1)
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x100000})
ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000fc0))
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1})
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="161a000004"], 0x50)
io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0xfffffffe)
syz_usb_connect(0x2, 0x46, &(0x7f0000000740)={{0x12, 0x1, 0x110, 0xcb, 0xc5, 0xef, 0x8, 0x110a, 0x1150, 0x559e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x34, 0x1, 0x0, 0x6, 0x70, 0x8, "", [{{0x9, 0x4, 0x46, 0x5, 0x3, 0x4d, 0xbf, 0xc, 0x9, [], [{{0x9, 0x5, 0x6, 0x2, 0x10, 0x4, 0x9, 0x2b}}, {{0x9, 0x5, 0x6, 0x4, 0x20, 0x2, 0xcd, 0xff}}, {{0x9, 0x5, 0xb, 0x8, 0x20, 0x8, 0xae, 0x5, [@generic={0x7, 0x5, "e35639a7a5"}]}}]}}]}}]}}, 0x0)

6.900458177s ago: executing program 0 (id=3027):
r0 = fsopen(&(0x7f0000000040)='ramfs\x00', 0x1)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r2 = openat$cgroup_pressure(r1, &(0x7f0000000100)='cpu.pressure\x00', 0x2, 0x0)
write$cgroup_pressure(r2, &(0x7f0000000080)={'some', 0x20, 0x2000000008, 0x20, 0x1}, 0x2f)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r3 = fsmount(r0, 0x0, 0x6)
fchdir(r3)
syz_mount_image$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x2a0000a, 0x0, 0x0, 0x0, 0x0)
r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0)
getdents64(r4, 0x0, 0x0)

6.844964445s ago: executing program 0 (id=3028):
openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0xe8, 0x0, 0x0)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x10, 0x0, 0x25dfdbfb, {{@in6=@private0, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x4, 0x4e24, 0x0, 0xa, 0x60, 0x20, 0x3b, 0x0, 0xee01}, {0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe}, 0x9, 0x0, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50)
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x0, 0x4, 0x0, 0x5, 0xffffffffffffffff, 0x0, 0x7, 0x0, 0x0, 0x2, 0x1, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x6, 0xfffffffffffffffe, 0x1, 0x0, 0x8000000000000000, 0x0, 0x0, 0xa, 0x0, 0x5, 0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x9, 0x2, 0x9, 0x0, 0x3, 0x800, 0x0, 0xffffffbffffffffe, 0x0, 0x7, 0x0, 0x7, 0x3f26, 0x0, 0x0, 0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffffffffffffe, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x8000000000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x1000000000000003, 0x0, 0x400000000000, 0x7, 0x2000000, 0x0, 0x0, 0x2000000, 0x0, 0x4, 0x800000, 0x0, 0x101, 0x0, 0x3, 0x0, 0x9, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x3a8, 0x200000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0xad3]})
r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0)
syz_usb_disconnect(r5)
r6 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0)
syz_usb_connect(0x1, 0x2d, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000009a65d0860040800dee20102030109021b05"], 0x0)
syz_usb_control_io$hid(r6, 0x0, 0x0)
syz_usb_control_io(r5, 0x0, 0x0)
syz_usb_control_io(r6, 0x0, 0x0)
syz_usb_ep_write(r5, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000")
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0)
sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}, 0x1, 0x0, 0x0, 0x40000000}, 0x4008000)
r8 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a0040"], 0xb8}}, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r10 = syz_io_uring_setup(0x315b, &(0x7f00000001c0)={0x0, 0xcfcb, 0x1042, 0x1, 0x354}, &(0x7f0000000140), &(0x7f0000000300), &(0x7f0000000180))
io_uring_register$IORING_REGISTER_PBUF_STATUS(r10, 0x1a, 0x0, 0x1)
r11 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x1)
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x4010, r11, 0x40000)
socket$unix(0x1, 0x1, 0x0)

4.755767137s ago: executing program 1 (id=3043):
socket$kcm(0x10, 0x2, 0x10) (async)
socket$inet6(0xa, 0x2, 0x0) (async)
socket$xdp(0x2c, 0x3, 0x0) (async)
syz_open_dev$mtd(&(0x7f0000000000), 0x492, 0x20800)
syz_ublk_setup_io_uring(0x1d, &(0x7f0000000400)={0x0, 0x30b5, 0x1000, 0x2, 0x158}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000040)) (async)
syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (async)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x40000100, 0x0, 0x400000000001}]}) (async)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=@ipv6_newrule={0x2c, 0x20, 0x2d2c6d60ea1da725, 0x70bd29, 0x25dfdbfd, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x12}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_SUPPRESS_IFGROUP={0x8, 0xd, 0x6}]}, 0x2c}}, 0x0) (async)
r5 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@deltaction={0x48, 0x18, 0x1, 0x70bd2a, 0x25dfdbfe, {0xa}, [@TCA_ACT_TAB={0x34, 0x1, [{0x10, 0x8f, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb8a}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x44801}, 0x20040844) (async)
r6 = add_key$user(&(0x7f0000000540), &(0x7f0000000580)={'syz', 0x0}, &(0x7f00000002c0)="7e9b69e96551fe222f75b49035185ea820ba0a157c14fd46358d17b50f48e7d7e79098a58ce0b9d091eab87299a63c76e187fd681cc924ed7254f3d34a8f0b37293553", 0x43, 0xffffffffffffffff) (async)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, &(0x7f0000000080)=0x9c) (async)
r7 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
r8 = add_key$user(&(0x7f0000000400), 0x0, &(0x7f0000000d00)="3e12d23d346cfdeb1716f738374bc1c03bee4423fa20837e6e86b86592e9be83d8ebbbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e43eba0b67b516be14a8b51a75bfd611b2d7ae6a21d056c2c5116a416a76b1a03dc55ea62d43c809e0ed6e56163fdab317afd5c34d614367e4425bb9a97e39fea3859296659bf4c2467159227ee717f4e959ac989e03926c4e20c2cda4efd37be90f502fd03e4748564d9", 0xac, 0xfffffffffffffffe)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r6, r7, r8}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={'sha256\x00'}}) (async)
r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r10 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r10, 0x0, 0x0) (async, rerun: 32)
syz_kvm_setup_syzos_vm$x86(r9, &(0x7f0000c00000/0x400000)=nil) (rerun: 32)
unshare(0x28000600) (async)
socket$can_raw(0x1d, 0x3, 0x1)
mq_open(&(0x7f0000000080)='!selin\xdb\xa1\x02\xbf\xd9l\xd7\xcd\xc0uxse\xee\x0e\xcd\xce6\xbf\xfa;\xb9-a\xb8\xef\x8de\x14\xbc\x9ej\xa1q\xa2\xa5\t\x98\x8a\x8f>\xba', 0x6e93ebbbcc088cf2, 0x0, 0x0)
unshare(0x8000280) (async)
r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]})
close_range(r11, 0xffffffffffffffff, 0x0)

4.637836934s ago: executing program 4 (id=3044):
setsockopt$inet_sctp6_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x24, &(0x7f0000001a00), &(0x7f0000001a40)=0x4)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x6, 0x31, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0)
pwrite64(r0, &(0x7f00000008c0)='/', 0x1, 0x0)
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0)
lseek(r0, 0x0, 0x4)
sendfile(r0, r0, &(0x7f00000001c0), 0x7fa)
symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00')
mknodat$null(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x1000, 0x103) (fail_nth: 2)
openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0)

4.515105894s ago: executing program 1 (id=3045):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000d40)={{0x14}, [], {0x14}}, 0x28}}, 0x0) (async)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6) (async)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async, rerun: 64)
syz_emit_ethernet(0x3e, &(0x7f0000000f00)={@local, @link_local, @void, {@ipv4={0x800, @generic={{0xc, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x73, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x36}, {[@ssrr={0x89, 0x7, 0xef, [@multicast1]}, @cipso={0x86, 0x15, 0x0, [{0x7, 0xf, "3332432bd3028cdf502ba5d40c"}]}]}}}}}}, 0x0) (async, rerun: 64)
r2 = socket(0x400000000010, 0x3, 0x0) (async)
r3 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0}) (async)
ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000180)={<r5=>r2, 0x1, 0x9, 0x3})
setsockopt$inet_sctp6_SCTP_INITMSG(r5, 0x84, 0x2, &(0x7f0000000200)={0x5, 0x1, 0x3, 0x5}, 0x8) (async)
r6 = socket$inet6_sctp(0xa, 0x5, 0x84)
ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000300)={'wg2\x00', &(0x7f0000000140)=@ethtool_perm_addr={0x15}}) (async)
r7 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) (async)
r8 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64)
ioctl$sock_netdev_private(r5, 0x89f2, &(0x7f0000000600)="4f48d732ae00634300eae94367625e86898ee87a59ac88ce27653ffb004c755e8f80d6f49b6e1d8c36625fb1827b95cd06d06c237b48f69451575f41a7280d9d282561389ed16430e557f3ef3b5dec00cb1f2f2aa330a0e2afa7052eac65dc16bfcb8d4f97d69e434bd452d6fa6c386a7e42187ca3284100b827379c7c5626ba526e98a08fbf7a2d5d878ce80546a57be2a56f779b4301c46491308dab79ed") (rerun: 64)
r9 = socket(0x10, 0x803, 0x0) (async)
r10 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r10, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={<r11=>0xffffffffffffffff}, 0x106, 0x8}}, 0x20)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r10, &(0x7f0000000080)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x7, @local}, {0xa, 0x0, 0x7ffffffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xa8a9}, r11, 0x40000002}}, 0x48) (async)
sendmsg$nl_route(r9, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async, rerun: 64)
getsockname$packet(r9, &(0x7f0000000140)={0x11, 0x0, <r12=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) (rerun: 64)
sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r12, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0xbf}]}}}]}, 0x40}}, 0x0) (async)
sendto$packet(r7, &(0x7f0000000240)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc9", 0x26, 0x40, &(0x7f0000000540)={0xc9, 0x0, r12, 0x1, 0x0, 0x6, @multicast}, 0x14) (async)
sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xffde}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000ac0)=@newtfilter={0x23c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xe, 0x7}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0x20c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x108, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x24, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xdd13}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1af}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x1c, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0xd}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x2}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xa}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x400}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x800}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xffff}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0xcc}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x2c, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0xf}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0xa44a}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_HWID={0x5, 0x4, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xe147}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x4c, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x5}]}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x3c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x30000}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xe}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7b}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}]}]}, @TCA_FLOWER_KEY_ICMPV6_TYPE_MASK={0x5}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0x94, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x2c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4000086}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x6}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x8}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x34, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x8c}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x9b}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x9}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xe7}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x3}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x1c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x7fff}]}]}, @TCA_FLOWER_KEY_ENC_IPV4_SRC_MASK={0x8, 0x1c, 0xffffffff}, @TCA_FLOWER_KEY_TCP_SRC={0x6}, @TCA_FLOWER_KEY_MPLS_TC={0x5, 0x45, 0x80}]}}]}, 0x23c}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newsa={0x13c, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x1234, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x4c, 0x14, {{'hmac(sha1)\x00'}, 0x0, 0xa0}}]}, 0x13c}}, 0x0) (async)
sendmsg$nl_xfrm(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newpolicy={0xfc, 0x13, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x1234, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x4d2, 0x33}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) (async)
r13 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_HOPOPTS(r13, 0x29, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00'], 0x8)

4.30365731s ago: executing program 4 (id=3046):
r0 = syz_usb_connect(0x3, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f211066865578ac0109029c000100000400090400bf900b64ea00090587033b"], 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000)
write$char_usb(r1, &(0x7f0000000040)='7', 0x1)
r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000001c0), 0x480, 0x0)
ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000340)={'\x00', 0x81, 0xffffffff, 0x3, 0xa, 0x4, <r3=>0x0})
timer_create(0x0, &(0x7f0000000100)={0x0, 0x21, 0x0, @tid=r3}, &(0x7f0000000300)=<r4=>0x0)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0xff7e, 0x7})
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0x0, 0x0)
syz_usb_control_io$uac3(0xffffffffffffffff, &(0x7f0000000280)={0x14, &(0x7f0000002500)={0x40, 0x23, 0xa2, {0xa2, 0x23, "91562e0dc87223b102bb2d7a444b1bd746ad68b6f12617f6cf8d3ae8a26132c5b98787569bc0cfa2c3afc2124593d90f7e09bff93669fba0bfd3a639e423e23312c3866c4b386571b6006f70c19d458f5b8c050a40000000cd8241c65d4fcbb7f5ca7efb847b184987b0b8b3e37d54c481181d8215a0a301cb8dc9b6d8c44dd0fbd1e2d515d6c92d1cbc82341ec0439b4464960fb6a33ceac0278a90f0bb6012"}}, &(0x7f0000000200)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xf0ff}}}, &(0x7f00000005c0)={0x44, &(0x7f0000002600)=ANY=[@ANYBLOB="4005460064cb4b1c87cd936ca2717e3328fba8fe62459249cc5564acf9e559f5e59395169f6fe902f8381dd20abefc9c746066552f990633339fb36119b50563ed1f79c0a6cfc3375ee5914822fcd0eb370ab10e22812bf94206b0ecaa633d0099d95194eb0157934ccae2fc928eb4afd4f0f1d9d4f4a3e26091a061b1e5ddbc9777cc329931d5b5908211830be43516da7544ef030eee0805f45c43cc472c590935d6f4157189c431a963a972d4aef5250895b883b9b0c1e886683b1a77ac395b182e28ded91188f829eb0d6d1012bec61f2559c41f54d2a84c"], &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x3f}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x8b}, &(0x7f0000000440)={0x20, 0x81, 0x2, "d705"}, &(0x7f0000000480)={0x20, 0x82, 0x2, "ffb1"}, &(0x7f00000004c0)={0x20, 0x83, 0x2, "a08e"}, &(0x7f0000000500)={0x20, 0x84, 0x1, "ca"}, &(0x7f0000000540)={0x20, 0x85, 0x3, "cfd703"}})
syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="04021d02000000000080099501358d3a0e00ffffffffffff030f08c097890400"], 0x20)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
ioctl$NILFS_IOCTL_CHANGE_CPMODE(r1, 0x40106e80, &(0x7f0000000080)={0x80000003})
r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
r6 = dup2(r5, r5)
read$FUSE(r6, &(0x7f0000000440)={0x2020}, 0x2020)
ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0)
write$char_usb(r1, &(0x7f0000000bc0)="be", 0x1)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e)
r7 = userfaultfd(0x1)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15)
madvise(&(0x7f00000d8000/0x4000)=nil, 0x4000, 0x3)
ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2})
syz_usb_disconnect(r0)
syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862)
clock_gettime(0x0, 0x0)
clock_gettime(0x0, &(0x7f00000025c0)={<r8=>0x0, <r9=>0x0})
timer_settime(r4, 0x1, &(0x7f0000002480)={{}, {r8, r9+60000000}}, &(0x7f00000024c0))
syz_usb_disconnect(r0)

4.270622371s ago: executing program 1 (id=3047):
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
syz_mount_image$fuse(&(0x7f0000002040), &(0x7f00000001c0)='./file0\x00', 0x8, &(0x7f00000003c0)=ANY=[@ANYRES64=r0, @ANYRES32=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYRES64=r0, @ANYRESDEC=0x0, @ANYBLOB=',default_permissions'], 0xfb, 0x0, 0x0)
syz_fuse_handle_req(r0, &(0x7f000000a100)="58785f58471eb4b5b3ff3946acaad41068511507291e72541d949ffc8a54ff637ccef1fe8511899ea7f3c82cbc6539763a34f6760c1608c911801ca672e62708ba4fc023749076ff6a0daba0caa57000acbd9ecf5e97201f7f14e715bc8c089c3d65e92fd65dedb76d61715067ccf6dfec2b56a48f2b274b564d90c3d868f2bdc07b7e636ad78904bca826fa69b7783e7be2b8e7c997b99225467747875695f6d500cb82b479fe9486bb94e06f796f89906bbfccc964830f86986760ade90c3f7a9dde3172a5124c1889075ad30b5ee2a5f257a6ac790a8e89b247ccbc8d241b7b95f8fc649deffc1bc37d51a8c3dfae38ac968eb48695de38df941f9632ef9ad6779e41ccea8a3ff1cac4fa4b47a152a8f9a1bb0094f41580bbf60fa11cfaf2c535a12c866e9414ee9b58226fbdb0d221e1bdc50e3fa300351364f6350030383856f1f809aee19f337f3d3435ae6754916be1eec24643cec1bd1007ffa38418735988cc901603895f66bd6450d54f99e1246ded898499d2a447f899c00368ce1dd4a4f4cf9cdf7d4f8b38d7b98a598ac490f1086ec712b0cb94610abfdb25b0f6947b46e1dd628897ab68445568578049fa6140250a5d821d70f102fadc2fa273a6e486f250712ec847de3b02a121e19775311e8629045f3404bdfa3207aecdac43c3571b86a9423bd716aa67cb688f9ee4f2b14ea42c89f2766c78fd4ec41ab34eebb4256e885bd7e3abe4348772993bb630aa3397084bbc66cdad664d6a9d33767cc375a44dbc0b08931053a6780a796fd31e1d7c512599f9e010883a52c07ec0938ce1acb3fe3baac6af9fb7e9d7942662e41bd3626d240d5ed34ebcbcc0ccf1c3280c76fbf6cdfb04bdb2d3b4ec6a8961b1eb036b211eff6247b95039cc67d222f2ff122340c56d74b4fffa79a202144bb10ad766f1fd6b3276342baf2fdbd26e9563dadd01fce19d7ec025d05d0494e53229379d13c1cae48ec058cff0bc1ccdc94a74b11a9bc87c580bb6a3f45fe15d15d89bf6102dc1085bfe27b2ab462aaf642b8ceed519cf88b31e9e00fdc23e8f6967a72b4c38b2458656dbf26dd75586731bb519a97d0ff43f4358cd40c7ed371ae8a24f46e320d4c4c0a1b8c42f10908a1c283d8032d76f52d4509d78c2f3a0716c37bc0c786ce9174a88d468e88a6d154e4712778aecded0ca5de28e52c04e33672ecea5135438e908aa1bf00e65ba6dacc4bd018b7bb1c30aa5d9acc679220cb5e7207f1759bd7722d10469225aae24973031a21358532a63aab42f33b1f8f40d545fec7799703ba067592b34247fbc7375acdcb3883ace7d34cf33484f2cf662f3f0e18b5c475ae311fb20f6e6b85320b2bc37e56512dc27815b37bfd9f172be1a119197eb53b535c440f97f24724e1d466309c0f8556965bd02d75c3dbe2baa0c6a515db07af1f77306577d0b38f0aa8cb188cf5523368951b8210f4bfc6afa0d058ad84656d27a46faef225e6268396ecb54a5182591bff3a86792db5454e238afe7c26eae85fd3c1c060760d89223bbdbe8966ae2558f47d799839cd959c974b69ad262cf8ab4fee554288e767ede9bc5d7f0cfba05966ef7858e41db363122680abe978345d45e4b52b73fe9f52ad26371a5b0539d88aa0c572aa01a41b079dde5a14e031ad903629d06c8d85ad82828c25a9ba7ce0fef2316eb011643e47feca7d280833f8b3008841fb2d88ea84df65b03aa5baaa29d6234ed5db8db461fc5df77aad38690277cd5dac1ed3c23c9f2778295578561f9a4d31159a826b4b62b2a867e6e8a9514edddaacad22106880e6633fb2f3b17c8d10bec633d6128489f7253b3e3e38e5942743ddd1547dfab27a152549f61891e3a5ad17f733b042f7ef915ad7423b9719fee9142407fe1d10ec8b64a21cd24fd39de4496ca3f394f07149bdbf1393181b5afee090ff40ee31d34a9c6a113e3823fac425fa85e212de1a9f7c4937ba64f3327961fccf85e6fa29be12de9589671d60d4658b1562ce7dedcde8ec79d265c13f5e197b66989c3f067d2801fcd78bb92b45e55fb4089a7cd3b179284af782ae0327ba56fc307a281772384448ee465dccefe41be8d75c8cd0eb5c0217d7ca706848f9b82500b77c2d838cbd536304556af87d3b6fb9183b5dc9cf2d0f7ecbb24d9f790151b9c6092dfb2c14decbe6448362cd7c13515f66a99c37b56134d12e8c7f1a5b75e14e47f84d8658f0b65ea91014e2e4fd361f03dbf8ca509d426ca1bba7e43ce918268393ff16b17d9e1bb49fb2b4f6eeb8b4b226c79303b19412a55b7ea7c8774ccebd8d66abe117a8be9a3c4faea730902136df57aff991b59dd71610ba4c8e1cded8287c21c56526f4fb6c502ea73ae310d56640990b3e695b278de6e1eebd51108cf7547c0e457e5fdf59691baf080dd3f5dc3c9a10bd4cc5e10ba42d4d3d9dc4f7ebe0bd2981a1d6fb06f7457dca1e56fac3f0fa7ca19ec2fb7940ee837e960d93a73bf085eaa2888fe3025aadd33cae85d63273be6ae3a92e35d78602d8e23b9460f04b7c0e0e710d10fdb0dd3fa9b880865603500d81dc7e968e8046569830b526e441f25f8b0af47d524aa80fd7dd9c3f72facec2032e2c06bc33c6b739c5368bf54e32b6acdca9d2d14276a8348ae92bfbd60f6aceecf98f3c6fe70747499b25667a96c52e21236421b27deafbc6b5e2b8a4ea2a0d3cd5ee1a10f3153b529b5c04a1961223a943842e17ee0cd114ce6983536400fc40f3d4708436954803fd60caf2b5ed7e4ce90bc75385e2424191c6a5038fa15d99aade49fa1affe63fb73078a6bb4ee560b0b521aeb33f507bdf876829f4d3f695197468e41503a10870a8e6df800608ac33dfdecc03f64d03fb6180287a684063c7edfc8db1366f6bb502fe446085f6acc4741b273a0b736f0f55da28967390bc7434db54ad0da9d1d002ceaa5c3e53efa95e7aaa792db32501a072e669da29fb734d771a6fa8c753fb2fcc204e31d668992473e7937fcf751bc79b125db1725f2a495bd2a4207e4db8d44810a4db5113705c5cb8733866ade3375d1bdbcb965cbd927e7d285f2933bf037911959088b64cfac0ff1e39244f2e9416653ed87ec564eb686af1062354a8bd7034c1022cb0d0b6996762ef4a0a3ab4f3deb459f023a867a38fcad2a10fcf0872862b386ff7c5ea7ce13abb112d1f0ed0723870eccc76d16f7e3cc00e28945bb93d9f2bd8e2017993102f0824867ec141f20df951202a2ab1cd796516ca0b4fdd9e6de8b82fcd30f9ab85cf0a5547e1ad1ef1ad5be7a878a16864d7c06b4ae002f3ba485a9bb36b8a591ecb64a4a5c0fd3b4beb015f58ea4cfe190f3b46cc4d9108d10c52a9de859814edac575d2a3d937a9b31db049e70aa76c085ab63d61c1317205c228f7027fa39125de8fec40ed7982e36a7cfa9fedca30f0b692bd4c7794f6b56d69ada1fed168cf03cc57321fe37e3a8cea4bd093e87b657fe5acb13d2591bebb526301d16707eaa38e52f913f8aa3e27b2387ca1a217ac69966e287ad5cb0286535d5d00b7006661dbc7923a066945c1a2040a4e95d7b0de4dc8217bf1d4e9b6cccc671fdd9a5770c21e749b407df8c463a3bf17e47bfcba6a890a0435d3fbb7252fe072b149b7bfeb185b088686dd70e0c9cda275497b553aff2b319f7d7b0ed64002c5f9f6ccfc3d55d8c908d314487452f37a650f4561326a84c660b6111702a87db03595b5d080c60288203f091de9f78b997e47233f4bab9b044a98ab118a6c45b7ca746cc2fb90182a923d67216412e24a955c0c2307acc47bdd319955249d8412a5ccf444437f53f524c69ba0167c920f0c1f775cd1a225636200a9e4adf61f418d20f717339d0c8c5386af0936f628cc589a8d5581c1c8cad0b564a3f38b606473280a3fa586a5ba932fd38eeb23096df29a92ab54c409f88ef4f03217f0bb90fea539e629d8a025c802f6b5c3d735fe950c8ff7136e6db287851dfbffea1ef81491a50cb75a103367e85afa3484d6af865dfbca91dc05632b0d94aa384ee0c585424a5ddf80babe0b913b0a2eedda34c7ea7814642a69f8eae868274b16fe0f52fb60b201e6685dad3f419413d5b8186992855a25ffe0d4773a14c7977181a120cbc42af4f9acca3fee1d54ccc125ea49b62ab60c58a0ecdf50ee7c16f3b6b12b254fc08fcc85d409eef7c3f30cf705617f926a17e6588a9fd7e34be9fd863a7b157a2d9a336356d568c2d2dbaf76c2d2b2ff8703748b860e36f02b04d6e4f2fd49511f12ce395dc18622cd51948a32cc432cd797d8a68838cebbbdd9bcb6f2e85719785706012e894cb043bb9a53998131fd4aae3321d81fc001e718c4a99c0580af1d4a0c81665cc5adcf337c8bc00fc0fb3c7be0d5e5ff6a6fae5891858eafedbed69223170ccc71ce36ae439d769c3520972601fbab93f54808d6950cb7cf1e5a3b32d8c6a975e3adccca0b2ee28a4eb5ca3b0ceb9d31a8f767c3f4486a62215171738007675a55abf5916513f7eb9b21ff291f2b4b48bbfcf394cf861fe016b3680be422a8bff49963ce096d1bc17186822b1392e68b1a05fa6c70bd2d9a164f12301a6e78caa8f4cd437497320d383e752dd224aeef80794d3f206741363e74fa181c9f1dc47557553de620794f096c59ccd74a178f5adb466ad5a62fffc1886f56ebceca4ed46ed2396bcbc31160b4eb1b7d69642e33315e3adbdbe1b9794931e7babf745ecfca37dd4190013793d530df12d6521bc069a05a94e0ffe91900a0c2209a6914d2f85bd161ff77284198129a9b1ba600bda3e52769d39c1bd61c4a70c627c3ad89aa0bdf0c93a2c35e166da9a08b4d2f92deacb6e9034274305b6d254c4052868ba32bec9aa3cec75debe24e78e43374efffe444722a983935f9007fe3de37dd83c52be16e034d09592a179275dd0c91281be579cd19c0162123886893713f25cdae19cf258926bf2070741111eee6b3df708c3fc416b7d046c948bf8500779c0cd5460e640bb1f860f58052b8087e6eb2f16e48f4984c9f9fc9fb2652ac5305861ece5362db08ae912ba055af766da1322057d0bfa647d98b8d4f1e7ed43ecdf1050c0eb19dae93b8014da57241cdab4ffacf0ec1348d4a89b3e8ff187098d83d8eba34e5c7ad4215f1977968a9d337d08fd1188754e7cf41baf0189ccaa5f3b1005f807b0255ce1920ca7d919e4684af70c3d089a99922727c607a2b06e713dd61122842a913036f6cd64dfb313fbdf639fcbd712852bb85337d056685b0a54225ae27e1e8c7ce5acd1f017b8f712c268b9cc0ee26d26c63f0a8b0a40fccec5f945431a2e81c35720d178feb481092e4f51978493c5fd502f252bc0152f145f268ead14932990069169483ecc7abc901657460c8730715c078b61059bd2621f50fb838376e0b808a3f118f761efea45bbac4274016960063cc67c428e72e516685552dc3bf473e442d76f2d3ed07b319694490054302a538b52e3b8496b7e37fbf4a2ffff2b484f98fdb14c66ecb8447834733f8a7a5a3c83de34b6647842dd56d8201f9d9240f3b3a5b5cbccf174a08853d06fd164fe74e04608ae12df8a35b73517d22a87c7ebca60942932d03102ff7e8644611b5520b5ebce950945498ce19210c866e48284d18fb7e049deaa43ee5283e3dfad7316ba85490e93182d13efe7ba64ee5ceeaabcff3eb24d46a3a129dd5a6b82e8c48210cb1e6564833f3e15dda4dec383b4319741cebf6374cf2c5d64722afccf7c4e2d81ae28d45f2c35b764281f1f08fec8f8e9277277ae1ae8a8981f85e041d2450afc9374e978f73b66da9aadb2087223f28e21e946eb07710ec86cdcad0948d4ca93827ea34e28806d172c3feb83471ed2d4d7ada2360b209d16b9d35861082d85b6be3c3589a6bdaf6f9b5d52ac8fd7388e32b24f1d5d34b5442c1ceebde311decd709f075d064f07bc60ab14c101ef51039eed56ae1e0a374e3e956603737b3a16db684a81e9b8998a0bb9b17a0876a92b2a3b9924f44b16ae4c7ff376ea8a8c91b504c1dbeb522cf846fc3ec6b9a01f452eeb35cade34c6a0463b92c46e013ee7906ee934141870ddd1464ae688805933504a2dc7cb1f947e28bf22f5eea6afb5de3b950056bf44065b84fd5589385d0feec4ef1db4fb4b595957130e575dc383e3686f4674143debb23e17b398f32683fb4805f297369d0e5f2e63af6891491e4e37186b4a3dffbbdcfff63d1fea4e12d24ef96fde3ed7a323a3605cdf5eaa43da738004556c2c20aa30c40079bc2e9ebe102c1fcf5259f1e3acc6b2a2bc9da4d0b1252433c58a1810581152a235e93deabf7f728eace350bcc4db4f249d4234bbd858c4e61a0eda4e3db0ae530c78eb63425502d651fd0cb986341ba69c44ede18eb3ebf25b2336cdda02447a9e20426d8206368c63b5fd6828612d3b99f627e331bab0009579de8270c36aa03861c300d34f2a3703870712325190073e6c17d8699f6744acb1b5468f93b57ab0366796181a4f543511d7ea2b32606c33cda61e81ed1c2194d305be47a3f1a9145d023620af12e79ec188573526ec35b9ce44e95fdb3530bd0431dd12a227d0ffe317cda1bbd787979261d6c9cf728b3d6bec3ba6ae15a595a30fc242bc5f25d837c1c642219afcfe043bb68a82965574b8b2139789235b262cf4af95a538e6954acf8e27ac3c95328df6e4bd615a376cd96bbc9e0d9802fbb40f80a848225e076219e26e0e63f57330b8bda69ec8dbd8b3272798cbfbb085b1885a1c22b3e2df2a879020ac1110b7af4f53ac97f556596ba0e164df0c85842026a87cf9631c9c9d851549efd8ca37e3b863e88436d5da5f4d3b5b5528e2d08d92b0d3ac6a06a0699653718e93a25b5afe254a068e300751eb6c67e3f5a1813d58d428f1ec108b88ec81444ccb50e8452941510c11f2e80bfd712f64b32b686c92ce922baf6c8eed1e9f0717a654d53b3ce1001880de80b5b15362b20286db9dfdf6c41f48aae84d5ab12ac45310f0eefc56e54113bcf95c1b2a259895af2ae9c679de4e2b898bf8a40a199a2059f8248c1303351dca3fb38906a682f66a94ee660debd6eaaee7b2f1051781084b3c9d626263d011a3daf971b708750a77614753b89b5e1a77a52510ced5708083fb48c554dfd6aacfcf97650f3a3b3f97566050e76da968d4eceb83bc1e005ed1596d6e0ec5e2c90231e62496d7435ec5b28f805e3b7aefdd3718e4ff53065b8e4b15175d80eec59218d8278e711c6049bf6d62ae7069578e957135463d7616b37c1e4bf44d60dac6c7aa04cbbc4a64bb0cc0b059abb6b26f8ed5203232ddd8a6c5882e6e6c53068a71bc84c5834104e85bc96db2163798a3881929248b8c788e5bdc9e46e5f7f3f6ad43fad6fa381a0b924bd938702470b330fb90ba73d557c0d203d55edaed6e3a01aeb53b061dad57713ab27e1a9e0d06b534a65d85beb061bb5258bbb38179ea612a6f402affb8ca018ebf0d6f61d44d5a657c080c7d2dbc9b08c07713b17b0f173ada59b57abb401212f4f1fa026491b48d08cf46a704ab43e46de8ea596d68658523b61a156278b3b77bd1f4491381bfd874ed72b00675fd5b4b7c0ec13c6837434ba8e22230d32e7bb1287e488e14f5c5602cd4ca88012b244c7f23f4897e27027aa862ca139bc8b5fe14be7554832ab02e4ba19699a1e66825d94c7c44451062819a38d3376f0a3716b210c7adf4bfbbc303058aa2e054b3bd53539764f177b11b05451705550f90196997de3d1d480e500cd9d234078cb1a09c63d8911381d327402702c2765fe92b8ba3a0189b2b11b7460996c36eaae3ecb4f4e63bfafd7953ff086dfc0b12e616bbdca4707631467b830d244bd3f4371744bc8a4baac728a397818875d1b6a4a2f0d10be607122a6fe813f52e4456b8a5eb6c9ee0cf889f777a03cc26a055f9f259cfc4f8552b568a4b371260af062619dfb215ecfe7b318f8d627d2777bd5103d6ca2948d19d5812112962b63c2bf3d090ff19185dbc5ad49a580451de717c0baa288cd96669babe88a8b1ab6d0936c4c407878786695f46f59ef06c5c2166b661542c598b6e0551d490946182841184a7a0e669c6ccd73a342f65c4525dc7522dccab15fa72bd07588b5bca71635b9466ca72a504c74cca1c573e8d40d83d1b5c5326481ff8a2055a2e0fb997fe8e4787deaa2a8a57afe74a971e7f1f280895f2fc9d99c41416adef7b70ec47e7a12d0ca3c0ab1dba3c2d65bb172fde1fcd7f97692d3d8c9657e3277ce95947d59bf37dde3f35f7a5d76575f5c14caf7f0926c0896995a5f42efd0d38c42de202bea5b5db39bf697f9a96b54aefec723db523893186634763e7399bfa8029c2708dc817984528601c77a1d78bd4b2c85f10f5ca9363badcdab51a1b315cafa5c2ef64f60395f53efb9d60d89e1b2a5f147508c90d2b09476eee3cb9b5957669a77cd2c522909480dea9be3406d1779ffe4539f2e03efb5f8c2d040f0ea776ff869a36862246294d0ced556a129ef78327617052dc1ef5cfb4e5986ba2f0e063b90e1657d8977b58827a3c4e3d556eb3cf0540685f7c9eda461aa2ecc539fec3d2d56be99a518f11752f2be2f670c5fbe8010ac4eae0ede31c1a48f747ff2eac9fc069d3700a40bf5fcda80a3a4f5fa920f117a72de6da51195d2d7f0cc92ff7835bce2ba6b564832f582df56b24cf30c8297a826a4bbfe0afeb1da3e986b3d0a95509e0037d212a70178ecb246061e067238ea9238e4c4a9a7c6fc5dcba290970f50c52598423336c523f2de7580d059fb53934cb0beb208585e897fafeba30853e54badefa197478fe6b9f26ed0d33babb53acee7b7221d8e0cad7a6bd0d9383ced6391bf88ca7aa50c75c136075e87b92445f02fbbc92f7cb65fe2bbe0bf0c9fc2577da63a56f1efbeb276c1f4d01da6f6f7a842212d96dd45edcd2aee7f2c553ace15eb9336bb1804ec252998c5c8b25033894b05c01ce7c77b73ec0e239478c67d5378fe5a53fe6269025d54006e9bb1cbd09b81a39615517c609f3d74e377888f641587121f0f097b48d8be85800295ebab9407978a9cd379966577cb6e1f5261e4305696a2cdd50d8cb1964d3ae18ec730d40f9c782533efba47db8378c6aa15ce85985e211fff2659729599802a7b585cbef3a2762595f67e2054a0fb4457b146e7a656abb2c4b2387d760f7e5b8b7864132317d5ba29a662f50af8dc182d2fbe216db8e997ac856bc59855ca48999699cd6c5576cc47bf8a8c30638c7e08847e5083aa82068940409461d1065c2b53292d3ab145d5bb590bcd278e48ebd34920b18a2e1731c1855ae5a3ed637ff568d205a08cf98c58f5d79c99912e6c1ab257ece0d68ef13d69a56364419aac7df43f43d5faa9ad851c9810648f9050012e55475109ca3ada3452b78a7964377e0d862e022c73ca3ed6cee8c5fbb2d7c12f91c4851fea7c5b02e0a3c5364b7fcca110f20f8858465c498d7e9c6049417fc5c7d4e0059852a6d794af426e938a401cf43b2ba9f4f3f6f0f2eb710ecf3c0c36c4b3072597f805eca9cb14602292ec7d5601e6b1555c8d024aa4bb81a4cff98cb03725cb184ea7dbed6814106a1402bf68a2e51660af930a500d5530651a0dbf2fdc01a31a99be25350b5c8a5fe01155343d028c03e09009ef2c386a24eba8d842cac581402c8faec7dca1623afe25a230d8d4a8bd23df3cf12abedc2a50e387285acf1b3105011a2bdefb204a53b20be213b50f5244511f25852271e05c03fb9a799ac7ea675ffbde8de181368748a9707674e7e70f28a75e4036b6cf9e0693f91a65be4478b6630067ad8dae030a4b7b9784a206b2f7cfeeefc65aae11fc20190f4d6387bab05fa6de640bfbfb0c4f604878771aeace0676d12325e61b19a5317c4d4bb9fe6f3fc8b171f1116528b7cbcc4a91c26a729b512196828075f4d0aeac98887e2a6a19b4e1f1f66233962961c0d49df14c3e6123c9ec8dd7152ad045000107365fd5ed7ce6a6d65ae0736a7e227f77c9b0903d4589ac58ceb691583cdb93ae3fc792c886663cb7c5b0640deb66e29b3c69d2f1a3d1d47d7b672ee3c49e90bd406aa84a0189808924c4e67c5495b045e779c58ca65b42889f52d7315c66be3716dc8592b4875629cd0cb02c29d42bdf9ca5c16bc9051c2a6c09d0695bfba58c19a995838c022e9936c407d8999aa65e4a9d6d8eff99f8dcfac9b561375b6d1293441b9d32533161062c053c63ef09f6100cd748700a710f5bfc2a6297b15242b1f41e21bd004b885d6429a0d334a8c115f7d53d278dad24c9d295b97c50eb340d1e6d523f1757e2014c1605c3bd35f0cfdb74f79850423a37e2f95dfe41c56df09724d21065377f1818311f0c70aaf6fb2d4fc8d9eef576136617371d85481770ce9c390859eacfebba34e75a238ce80bcccadd6c42e8e186be3c15451131fbe9e345c05ab8e23f917d269686a9b5f06dd474f95757b9e5a3328416595539cbdfa69efa9702e5a268b1a70c6e5ff2c118a6e574bfecf17b1576e4f2f7ee566b0b2b5388476a68562991ac01412fa463b0f9e586ad4bde59e91a4b303268b5d8644cb7996cfbba422facd59875ed6ac057e563412255c412be0928a0b6fdb6f35d7008b5d5528ca796a4a69bd90b993a52da9c7d62f4b71a2763f822bb39f3ed39cc5ad5a4d51b5c27d31d105000f3f1e705ed5c42067106f3fe6d30151021bcab7f3a1ad9175b3d3644325aa676b9e057bf9d9aa3348b1d9b31bd639c59bb63f46a6c18794ae006db3b1ee20368160a82e26aee5a9fdc6b44df8be294f3ac0a1275e57ebf5e384b141ce89dd51aaf2248274468894645ba54bc4e6b9788b1eb5043c1f0dffe2e13c6179d0238d8cd037b6fe3e484445ab458fa09e4e8010d3288aa6e6cdbfba4b62c7984d058da8993d5de1df75a1ce8e3bd5875709fd2ede4cd5843e7102ed4031ed096a0c6e3ae9d522ad95ef4af83599507dd32fe3325819cdd7718c9797e921e6e365175e1dd53991edcd2baf27df8b1670d01967e97b3e3e75d297f908deedf2e3b91bd61973e8aa75a5a6f9db11525dd35556bbd13873602a320af74677832f93bd01f1e0631c882c8ab254a26b73a60a6c90cf9b96bd576e05b9befbce882c5d29198451bd15acaa894a5276ea9d870f49a33ee9d2429ef35a905b281deb75be54fa0c9e47be5876d7dce01986f2d0e7ae6df9b87a0ba6cfa55cec0c65dd386db5adc427eac18a00c9aded475417add4ebb8880ef3dd218a9ec3e6e13456f8de1630774e918fe5288dbaec3dd2a74698ec9e28ad573761b9e78af3d5c7a61e3eefc1a54c25bb841529b3fc9137836a2e7eff5ffae8e44f0257160da51ec0b3d144b92f1f43d2782513705baf5930903602d40cb4de87feca7243d2248a78a5d684e303ae147acc96e0b755eea77092b5f6efa723afc6c9a44c575738725815a9af1ced500", 0x2000, &(0x7f0000000200)={&(0x7f0000000580)={0x50, 0x0, 0x100000001, {0x7, 0x28, 0x77, 0x2143040, 0x7f7f, 0x9, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffd}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r1 = socket$xdp(0x2c, 0x3, 0x0)
r2 = socket$kcm(0x11, 0x3, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000380)={'veth1\x00', 0x4})
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000001000010400000000fdffffff00000000", @ANYRES32=0x0, @ANYBLOB="ecf4ffff00040000"], 0x20}}, 0x2400c814)
r4 = socket$netlink(0x10, 0x3, 0x14)
preadv(r3, &(0x7f0000000300)=[{&(0x7f0000000340)=""/4, 0x2}], 0x3e8, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local})
r5 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
setsockopt$sock_attach_bpf(r2, 0x107, 0xf, &(0x7f0000000600), 0x56)
sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}]}, 0x0)
getsockopt$XDP_MMAP_OFFSETS(r1, 0x11b, 0x1, &(0x7f00000000c0), &(0x7f0000000180)=0x80)
syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006325a640402000498b4d000000010902240001000000000904000002214c6a0009050702000000da000905890e"], 0x0)
r7 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0xa00, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1)
syz_clone3(&(0x7f0000000480)={0x800, &(0x7f0000000100), &(0x7f0000000140)=<r10=>0x0, &(0x7f0000000180), {0x5}, &(0x7f00000002c0)=""/65, 0x41, &(0x7f0000000340)=""/105, &(0x7f0000000440)=[0x0], 0x1}, 0x58)
sched_setattr(r10, &(0x7f0000000640)={0x38, 0x0, 0x24, 0x7ffffffc, 0x800c1a, 0x7, 0x200000000000006, 0x8, 0xd, 0x8}, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil})
r11 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$KEYCTL_MOVE(0x1e, r11, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x1)
ioctl$KVM_SET_REGS(r9, 0x4090ae82, &(0x7f0000000200)={[0xe42, 0x9, 0xfffffffffffffffb, 0x5, 0x10000, 0x3, 0x4002004c2, 0x100000007ff, 0x1, 0x0, 0x10000000000400, 0x80, 0x8b, 0x0, 0x8, 0x8b], 0x58000, 0x240046})
syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0)
memfd_secret(0x80000)
syz_open_dev$vim2m(&(0x7f0000000040), 0x7, 0x2)

3.816043272s ago: executing program 3 (id=3048):
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
socket$inet6(0xa, 0x3, 0x8000000003c)
add_key(0x0, 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a861486f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe14", 0x37f, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="240000001a005f0400f9f407000904018002200000000000000000000800010000000000", 0x24)
sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="68020000", @ANYRES16=0x0, @ANYBLOB="010225bd7000fbdbdf25040000000800030007000000080002000104000005000600060000000800030007000000080002000101000014000100fe880000000000000000000000000101050005000200000008000200fffbffff0800030003000000"], 0x68}, 0x1, 0x0, 0x0, 0x20000040}, 0x4008811)
sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x8000000)
writev(0xffffffffffffffff, 0x0, 0x0)
r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0)
openat$adsp1(0xffffffffffffff9c, &(0x7f0000000480), 0xa6f81, 0x0)
sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50}, 0x24000085)
r3 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000100)={0x0, r3, r3}, 0x0, 0x0, 0x0)
getpeername$inet6(0xffffffffffffffff, &(0x7f0000000340)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000380)=0x1c)
ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, &(0x7f0000000180)=0x6f)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r4, 0x0, 0x0)
r5 = dup2(r2, r2)
ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f00000001c0)=0x2)
fsopen(&(0x7f00000004c0)='nfsd\x00', 0x0)
read$FUSE(r5, &(0x7f00000063c0)={0x2020}, 0x2020)
r6 = fsopen(&(0x7f00000003c0)='ubifs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000400)='{\x00', &(0x7f0000000440)='\x00', 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

3.019941421s ago: executing program 0 (id=3050):
r0 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c)
recvmmsg$unix(r0, &(0x7f0000006140)=[{{0x0, 0x0, &(0x7f0000002500)=[{&(0x7f0000000440)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000)=0x96f3, 0x4)
sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}, 0x2000000}], 0x400000000000181, 0x9200000000000000)

3.000326429s ago: executing program 2 (id=3051):
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0)
socket$netlink(0x10, 0x3, 0x15)
r0 = socket$netlink(0x10, 0x3, 0x0)
writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="290000001e00190f00003fffffffda060200000000e80001dd0008040d0008000c0000000005000000", 0x29}], 0x1)
ioctl$XFS_IOC_FSBULKSTAT_SINGLE(r0, 0xc0205866, &(0x7f0000000680)={&(0x7f00000001c0)=0x81, 0x6, &(0x7f0000000340)=[{}, {}, {}, {}], &(0x7f0000000640)})
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'team0\x00', <r1=>0x0})
r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100), 0x21c403, 0x0)
ioctl$SNDCTL_DSP_GETOPTR(r2, 0x800c5012, &(0x7f0000000140))
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYRES8=0x0, @ANYRES64=r1, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x20000001)
unshare(0x22020600)
r3 = socket$packet(0x11, 0x2, 0x300)
r4 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c)
syz_emit_ethernet(0xbe, &(0x7f00000000c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb0800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424dbcfd56f137546acaaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1d19cb307b3472ab98e030000000000000000000c0000000000000000"], 0x0)
recvfrom(r4, 0x0, 0x94, 0x10132, 0x0, 0x0)
sendto$packet(r3, &(0x7f00000000c0)='\t', 0x1, 0x100400c1, &(0x7f0000000200)={0x11, 0x8100, 0x0, 0x1, 0x87, 0x6, @random="4606512dfc66"}, 0xff8e)
ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f0000000180)={r4, 0x4, 0x408000104, 0xa})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0)
r5 = socket$netlink(0x10, 0x3, 0x0)
openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x105601, 0x0)
sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0xe0)

2.717621874s ago: executing program 0 (id=3052):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt(r1, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c)
setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000080)={0x3}, 0x1)
sendto$inet6(r1, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
write(r1, &(0x7f0000000340)="2f13", 0x2)
sendto$inet6(r1, &(0x7f0000000140)="87", 0x34000, 0x20004000, 0x0, 0x0)
sendmmsg$inet(r0, &(0x7f0000000640)=[{{&(0x7f0000000680)={0x2, 0x4e23, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000580)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x7}}], 0x18}}], 0x1, 0x4)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f00000000c0)={'wg2\x00', <r3=>0x0})
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@bridge_delvlan={0x0, 0x71, 0x10, 0x70bd2a, 0x25dfdbfb, {0x7, 0x0, 0x0, r3}, [@BRIDGE_VLANDB_ENTRY={0x0, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_MCAST_ROUTER={0x0, 0x6, 0x7}}, @BRIDGE_VLANDB_ENTRY={0x0, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x0, 0x1, {0x0, 0x1}}}, @BRIDGE_VLANDB_ENTRY={0x0, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_MCAST_ROUTER={0x0, 0x6, 0xe9}}, @BRIDGE_VLANDB_ENTRY={0x0, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_RANGE={0x0, 0x2, 0xd}}, @BRIDGE_VLANDB_ENTRY={0x0, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0x0, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_ID={0x0, 0x1, 0x5}}}, @BRIDGE_VLANDB_ENTRY={0x0, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_MCAST_ROUTER={0x0, 0x6, 0x79}}]}, 0x3c}}, 0x4000)

2.284485726s ago: executing program 3 (id=3053):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0)
r1 = socket$l2tp(0x2, 0x2, 0x73)
bind$inet(r1, &(0x7f00000002c0)={0x2, 0x4e20, @broadcast}, 0x10)
connect$inet(r1, &(0x7f0000000200)={0x2, 0x400, @remote}, 0x10)
sendmmsg$inet(r1, &(0x7f00000075c0)=[{{0x0, 0x0, &(0x7f0000004580)=[{0x0}, {&(0x7f00000021c0)="d8", 0x1}], 0x2}}], 0x1, 0x0)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000680)="f7790066baa0006eb86b42460f22c7d466470fe82000b8e20066ef0f2992902cbb000000e2b13a338c88d9000010292966f6440f386b410f7842288a0f920792070000000f01d9c4033921820f47a753fd", 0x51}], 0x1, 0x5b, 0x0, 0x0)
syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, 0x0}], 0x1, 0x3a, 0x0, 0x0)
ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000040)={0x8, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}, {}, {<r4=>0x0}]})
ioctl$DRM_IOCTL_UNLOCK(0xffffffffffffffff, 0x4008642b, &(0x7f0000000080)={r4, 0x19})
ioctl$KVM_RUN(r3, 0xae80, 0x0)

2.271694905s ago: executing program 1 (id=3054):
syz_usb_connect(0x3, 0x63, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c032090400000208065000070501020002000705820200020009040001040806"], 0x0)
syz_usb_connect(0x3, 0x63, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c032090400000208065000070501020002000705820200020009040001040806"], 0x0) (async)

2.163150546s ago: executing program 3 (id=3055):
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
syz_mount_image$fuse(0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000'], 0x1, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='new default trusted:syz -922337'], 0x2d, 0xfffffffffffffff9)
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xfffff, 0xfffffffffffffffe)

2.079654049s ago: executing program 4 (id=3056):
setrlimit(0x2, &(0x7f0000000000)={0x0, 0x2400000})
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000001180)=0x2000000)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0) (fail_nth: 1)

1.999407339s ago: executing program 3 (id=3057):
setrlimit(0x2, &(0x7f0000000000)={0x0, 0x2400000})
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7)
semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f00000001c0)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x1a0}, 0x1, 0xffffffffffffffd8, 0x0, 0x0, 0x0, 0x0, 0xb})
r1 = syz_open_procfs(0x0, &(0x7f0000000480)='maps\x00')
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0xc0686611, &(0x7f0000000180)={0x6b, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil})
ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000001180)=0x2000000)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0)

1.677967607s ago: executing program 0 (id=3058):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x50a32, 0x23}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_FWD_MASK={0x6}, @IFLA_BR_GROUP_ADDR={0x9, 0x14, @random="15714bc789a3"}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x1}, 0x4008000)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc29b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x0, "", [{{0x9, 0x4, 0x0, 0x25, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x4}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)

1.612698916s ago: executing program 3 (id=3059):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = socket$unix(0x1, 0x2, 0x0)
r3 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x9}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000014}, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
r6 = socket(0x400000000010, 0x3, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f0000002280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0x6}, {}, {0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x54, 0x2, [@TCA_BASIC_ACT={0x50, 0x3, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0xfffffffffffffff4, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x6, 0x6c000000, 0xf, 0x5, 0x4007c9}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x4)
r7 = epoll_create1(0x0)
r8 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2)
r9 = memfd_create(&(0x7f0000000700)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\xc2%/u\x17\xdaM\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d_\v\xfc\xad\x0f\xa8\xc5\xad\x00\xc2\x12\xff\xff\xff\xff\xff\xff\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc3Gj+kV$\x80\x8aJ$\x81\xc0\x16\xf5\x9cz\x10\x97\xdb\x12H\xee/\xe3sY\x02D;L~\xd0\xb44\x01*\xfb\xa4 \xb2b\x90H$\xb2\xad\xbf\x8aM\xb6\x81\x81^\x02\xa0\xa7t\xfbHb\xa5=\xdd+$\xc06J\xb4\xf0\xab\x85Xz\x9f\xb2D$\xbe\xd9\x7f-\r\x9aj9r\n_\x11\xd4\x19\xb0\xa0G\xb7\x94\xf7\xfd~\xe9\xb6G\xbfE\xbb\x15\x15\xa6\xca2\xd0\xd3\x8c\xf7nO\xf9\xa8\xfd\x8a\xd2\xb2\xab\xff\xe4\xb0;\xd9\xa8\f\x03R\xbd%\x9fF\xee\x05\x06.3(QF?\f\x05\xa4uY\xee\xab\x8a\xeb~\xed\xcb0\xb7\xe7\xe6?8g\x8aN\xda\x8f\x9d\xde\x1eNaS\x8fLk\xf1\x965N\x18\x8c\xb9=5\x991\xae\x89N\x13\xd1\xf7\xf0\x13\xb2\xaeS\xa1\x97\x18j\xea\x9f\xde\xb6\xd4\xdc\xe6*\x9c\xfdV\x82\x05', 0x2)
r10 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x80000)
ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r10, 0xc2604110, &(0x7f0000000040)={0x6, [[0x10009ef9, 0x2, 0x6, 0x0, 0x2000001, 0x0, 0xa], [0x0, 0x2, 0xfffffffc, 0xfffffffc, 0xfffffffd, 0x2, 0x8, 0xdc], [0xffff, 0x3, 0x7, 0xffd, 0x0, 0x5, 0x2, 0xfffffffd]], '\x00', [{0xfff, 0xfb}, {0x9, 0x90002}, {0xffffffff, 0x4}, {0xffffffb, 0xfffffff, 0x0, 0x1}, {0x403, 0xffffffff}, {0x1, 0x86}, {0xfb7f, 0x3}, {0x20000, 0x4}, {0x3e47, 0x7f}, {0xfffffff7, 0x400}, {0x0, 0xfffffffe}, {0x401}], '\x00', 0x1, 0x0, 0x0, 0xf8})
ftruncate(r9, 0xffff)
fcntl$addseals(r9, 0x409, 0x3)
close(0x3)
r11 = memfd_create(&(0x7f0000000080)='/dev/udmabuf\x00', 0x7)
ioctl$UDMABUF_CREATE(r8, 0x40187542, &(0x7f0000000000)={r11, 0xfffffffd, 0x0, 0x10000e000})
epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r0, &(0x7f00000001c0)={0x10000014})

1.60517039s ago: executing program 2 (id=3060):
unshare(0x2040400)
r0 = socket$netlink(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, 0x0, 0x0) (async)
r1 = fsopen(&(0x7f0000000200)='mqueue\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="ac0000000308050000000000000000000300000806000240809b00002400048008000b4000000800080002400108000640007d23d02da395b4c5fd00000b08000740ffffffff2400040038e097f1800800060000000908007602414f39b35227f727f53011de0340000000810800014000000007080007400000007f090001007379162fe258f54fbe9b010073797a31000000000600024000f900001c000480080001400000969a080001400000000508000140000000020100"/197], 0xac}, 0x1, 0x0, 0x0, 0x4040004}, 0x0) (async)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) (async)
r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async)
ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0505405, 0x0) (async, rerun: 32)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000140)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000ce0100000000d0085a168d0bf46d32345653600648d0a00120002", 0x3d, 0x0, 0x0, 0x0) (async, rerun: 32)
r3 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x24004894}, 0x0) (async)
ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000a80)={0x5, <r4=>r2})
ioctl$HIDIOCGREPORTINFO(r4, 0xc00c4809, &(0x7f0000000ac0)={0x1, 0x3, 0x5}) (async)
sendmmsg(r3, &(0x7f0000000000), 0x400000000000235, 0x0) (async, rerun: 64)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64)
sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYRES64=r1], 0xa0}}, 0x40)
dup3(r5, r1, 0x0) (async)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r1, 0x4048587b, &(0x7f0000000900)={{<r6=>r1, &(0x7f0000000240)='mqueue\x00', 0x40000, &(0x7f0000000280)={@align=0x100000000, {0x3, 0xe745, 0xf4, 0x2d}}, 0x81, &(0x7f00000002c0), &(0x7f0000000300)=0x6}, 0x7, &(0x7f0000000800)=[{0x3, 0x5, &(0x7f0000000340)='mqueue\x00', &(0x7f0000000380)="ef6cbf2c5ab51e88436b700e288a23e7bfa25dbe02bfbffa9e75df3b805ae15f5d8aa0d82a9bdd08acd7c1f035ea92d7e151e87b8589b8e70f6c3912968be26239b2a2f42ba5d46beb9c2c1dfd6a9ab7e4e42e2f4e8d3549d7b287fb92220a4554936fadf37099fa36e490f6784010477f60c7a7d94a05819657722be2c3b0f3ae7a6ae0d307ca73252217daa8434b0bdece696299deca2ec4b8aa83a97fd0d254497b221a1a87e24d7b9a6f2b31e686bfac19f6374d86", 0xb7, 0x29}, {0x1, 0x8, &(0x7f0000000440)='@\x00', &(0x7f0000000480)="8b47f19395d7aafbad525da82778b7c289d71b66c4301bafe71686d469c8a055acb412e9a9cf9af297", 0x29, 0x12}, {0x3, 0x8, &(0x7f00000004c0)='syz1\x00', &(0x7f0000000500)="be6d0cf21f48a3b3c216d5ed0bf646b1130a84b952e5190b4c4dc11919c015cdf6ec631f1435", 0x26}, {0x3, 0x3, &(0x7f0000000540)='syz0\x00', &(0x7f00000005c0)="1e7c82af7cf0a1b670b6f00378a862edacadb5f50803235874bc1fb947b8e3cabd6289a2a98202f314a26a274dc39a893f8efd2186d85a5b82ab30546a84c1dd4b5da95fde6eea5ba6c620dbc1bde2635bbe7e525bfcd717970b69c9f43fdd1ff2834dd91ff00039fabc3ac432", 0x6d, 0x1e}, {0x2, 0x1, &(0x7f0000000640)='mqueue\x00', &(0x7f0000000680)="a6e54d99d4e7256de5492a0c3870c98b43254cba25a75be7f68e2f26611a8992015d79f467716ad285a3c8e2d1cf4b93ff89c527ad0526d14d792a5269149684ee9065f7f15dfafe6d2cd8dbcf4dee14", 0x50}, {0x2, 0x10000, &(0x7f0000000700)='syz0\x00', &(0x7f0000000740)="6aa07ecfac22e65708b872f47fe8373060631c7921710de26b9b4115b7f6180788ba5c8a3bae0a310e29fadc27ff2c02cc4aad4f", 0x34, 0x28}, {0x1, 0x8594, &(0x7f0000000780)='mqueue\x00', &(0x7f00000007c0), 0x0, 0x12}]})
ioctl$MEMISLOCKED(r6, 0x80084d17, &(0x7f00000007c0)={0x7fff, 0x574f})
mlock2(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1) (async)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b595000000000000000002000000", @ANYRES32, @ANYBLOB="140001000040000000000000000000000000000014000200fe8000000000000000000000000000aa140006"], 0x54}}, 0x0)

1.604922128s ago: executing program 4 (id=3061):
r0 = fsopen(&(0x7f0000000040)='binder\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0)
write$binfmt_aout(r2, &(0x7f00000001c0)=ANY=[], 0xff2e)
ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0xfe, "0062ba7d82000000160000000000f738096304"})
r3 = syz_open_pts(r2, 0x800)
r4 = dup3(r3, r2, 0x80000)
read(r4, &(0x7f00000000c0)=""/226, 0xe2)
pselect6(0x40, &(0x7f0000000340)={0x7ab5, 0x1, 0x8000000000000000, 0x80000001, 0x3, 0x1ff, 0x9, 0xfffffffffffffffb}, &(0x7f0000000380)={0x7, 0x8, 0x9, 0x80000000, 0x0, 0x20000000000000, 0x3, 0xfcc}, &(0x7f00000003c0)={0x8, 0x8, 0x0, 0xffffffffa8fb74ae, 0x401, 0x80, 0x6, 0x8}, &(0x7f0000000400)={0x77359400}, &(0x7f0000000480)={&(0x7f0000000440)={[0x80000000]}, 0x8})
read$watch_queue(r4, 0x0, 0x0)
bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0xe, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x3}, 0x50)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
unshare(0x8040480)
r5 = syz_open_procfs$namespace(0x0, &(0x7f0000001380)='ns/cgroup\x00')
open_by_handle_at(r5, &(0x7f0000000280)=ANY=[@ANYBLOB="20000000f100000006"], 0x0)
r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff)
r7 = syz_open_procfs(0x0, &(0x7f0000002040)='net/snmp6\x00')
read$FUSE(r7, &(0x7f0000000000)={0x2020, 0x0, 0x0, 0x0, <r8=>0x0}, 0xfffffc7a)
getgroups(0x3, &(0x7f0000004400)=[r8, r8, r8])
socket$inet_icmp_raw(0x2, 0x3, 0x1)
sendmsg$ETHTOOL_MSG_LINKINFO_GET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x18, r6, 0x1, 0x70bd2b, 0x25dfdbfc, {0x1a}, [@HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x8081}, 0x4000000)
r9 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x3}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffffffff}]}]}, 0x5c}}, 0x0)

1.488051124s ago: executing program 2 (id=3062):
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$packet(0x11, 0x2, 0x300)
openat$sndseq(0xffffffffffffff9c, 0x0, 0x40) (async)
socket(0x2b, 0x1, 0x1)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f0000000b80)=[{{&(0x7f00000002c0)=@rc, 0x80, &(0x7f0000000800)=[{&(0x7f0000000340)=""/13, 0xd}, {&(0x7f0000000380)=""/7, 0x7}, {&(0x7f00000003c0)=""/65, 0x41}, {&(0x7f0000000440)=""/255, 0xff}, {&(0x7f0000000540)=""/220, 0xdc}, {&(0x7f0000000640)=""/235, 0xeb}, {&(0x7f0000000740)=""/9, 0x9}, {&(0x7f0000000780)=""/75, 0x4b}], 0x8}, 0x4}, {{&(0x7f0000000880)=@tipc=@name, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000900)=""/207, 0xcf}, {&(0x7f0000000a00)=""/122, 0x7a}], 0x2, &(0x7f0000000ac0)=""/58, 0x3a}, 0x1}], 0x2, 0x2, 0x0) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x8, 0x0)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) (async)
r3 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1)
fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) (async)
fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='tesR_Qummy_encryption', &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) (async)
r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) (async)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) (async)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) (async)
mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) (async)
ioctl$KVM_SET_SREGS(r4, 0x4138ae84, 0x0) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4004000) (async)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async)
sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34)
getpid()

1.084106044s ago: executing program 4 (id=3063):
r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r0) (async)
ptrace$setregset(0x4205, r0, 0x1, &(0x7f0000000200)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c504000000000000006cc55c", 0x98}) (async)
r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async)
r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$sock_TIOCOUTQ(r2, 0x5411, &(0x7f0000000400)) (async, rerun: 32)
ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f00000002c0)=@overlay={0x8, 0x4, 0x4, 0x0, 0xd, {}, {0x1, 0x0, 0xf, 0x7, 0x3, 0x81, "354e1474"}, 0x6, 0x3, {}, 0xffffdfb7}) (async, rerun: 32)
mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xe032, 0xffffffffffffffff, 0x80000000) (async)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
socket$nl_audit(0x10, 0x3, 0x9) (async, rerun: 32)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f815108f6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e67", 0x26f}], 0x1}, 0x0) (async, rerun: 32)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async)
sendmsg$NFT_BATCH(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @objref={{0xb}, @void}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010)
r4 = socket$inet6(0xa, 0x1, 0x84)
setsockopt$sock_linger(r4, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xffffffff}, 0x8) (async)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0xfc, 0x65, 0x0, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x8, 0x2}, {0x0, 0x1}, {0x5}}, [@filter_kind_options=@f_bpf={{0x8}, {0xc8, 0x2, [@TCA_BPF_ACT={0xc4, 0x1, [@m_tunnel_key={0xc0, 0xf, 0x0, 0x0, {{0xf}, {0x4}, {0x90, 0x6, "49faabd009eada9d7be60c407dafa92f49e8cd3a8f4fa8421129f6125120e80ad1f39b81fe547f4b02f63246313a813a99ecef91e6d9ef24aa123d4ec0ae96adae785c4e501ba800b202cd14d8c0016fc9c4f3ebc53feced9d30abb38c8943dce2293b002415feb1aef9c5838b7441da572c3dbb88fe9a038660b5a726819d6ad3215a715506b990b3cb6a94"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x4}}]}, 0xfc}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080)
r5 = socket(0x10, 0x803, 0x0) (async, rerun: 64)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 64)
close(r6) (async, rerun: 32)
r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000300), 0x80582, 0x0) (rerun: 32)
ioctl$TUNSETOFFLOAD(r7, 0xc004743e, 0x110e22fff2)
ioctl$TUNGETVNETLE(r6, 0x4004743b, 0x0)
sendto(r5, &(0x7f0000000040)="120000001200e7ef007b00000000000000a1", 0x12, 0x4044084, 0x0, 0x0) (async)
r8 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581)
r9 = fcntl$dupfd(r8, 0x0, r8)
ioctl$USBDEVFS_SUBMITURB(r9, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x0, 0x0, 0x0, 0x7995}, 0xfff7, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) (async, rerun: 32)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0) (async, rerun: 32)
ioctl$USBDEVFS_REAPURB(r9, 0x4004550c, 0x0) (async, rerun: 32)
recvmmsg(r5, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000540)=""/106, 0x6a}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/185, 0xb9}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) (rerun: 32)

1.032101845s ago: executing program 3 (id=3064):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x5}}, [@TCA_STAB={0x0, 0x8, 0x0, 0x1, [{{0x0, 0x1, {0x0, 0x5, 0x9, 0xbfb, 0x0, 0x1, 0xcd7}}, {0x0, 0x2, [0x8, 0x1ff, 0x8, 0x8000, 0x0, 0x2]}}, {{0x0, 0x1, {0xb, 0x3, 0x4, 0x8000, 0x1, 0x8001, 0x40}}, {0x0, 0x2, [0xe, 0x2, 0xc, 0xff81, 0xfff, 0x28a, 0x2, 0x6]}}, {{0x0, 0x1, {0xf, 0x81, 0xfff9, 0x21, 0x0, 0x2, 0x3}}, {0x0, 0x2, [0x1, 0x7, 0xb, 0xc3cd, 0x708]}}, {{0x0, 0x1, {0x81, 0x0, 0x2, 0x10, 0x2, 0x10000}}, {0x0, 0x2, [0x3]}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x88c1}, 0x0) (async)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0}) (async)
r5 = socket$kcm(0x11, 0x3, 0x0)
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async)
r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r7)
r8 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r9=>0x0}) (async)
r10 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0)
syz_usb_ep_write(r10, 0x81, 0x8, &(0x7f0000000080)="00012c615bc20000") (async)
syz_usb_control_io(r10, 0x0, &(0x7f0000000740)={0x84, &(0x7f00000001c0)=ANY=[@ANYBLOB="030701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r11 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
read$char_usb(r11, 0x0, 0x0)
sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x3f, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x83, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4000004) (async)
r12 = socket(0x1e, 0x805, 0x0)
bind$inet6(r12, &(0x7f0000000040)={0x1e, 0x4e22, 0x0, @mcast2, 0x8001}, 0x1c) (async)
sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r9, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0x1}]}}]}, 0x3c}}, 0x4890)
ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f00000004c0)=@xdp={0x2c, 0xdd86, r9, 0xb}, 0x80, &(0x7f0000000280)=[{&(0x7f00000024c0)='\'', 0x1}], 0x1}, 0x4048824) (async)
sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xb}, {0xfff1, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) (async)
r13 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r13, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="d800000025"], 0xd8}, 0x1, 0x0, 0x0, 0x4004041}, 0x20004440)

862.2917ms ago: executing program 4 (id=3065):
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0x6, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xcc26, 0xffb, 0xae, 0xb69, 0xc1, 0x81, 0x1, 0x3, 0x5, 0xa1, 0xffc, 0x9, 0x701, 0x3, 0x40001, 0xfffffffa, 0x4, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0xb6, 0x6, 0x1c00, 0xb, 0x8, 0xbed4, 0x2000008, 0x8000100, 0x3, 0x0, 0x8, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x5, 0x4, 0x7, 0x7, 0x10, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180001, 0x4007, 0x6, 0x2, 0x2af, 0xf7, 0x5, 0x2, 0x6, 0x6, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x0, 0x401, 0x752, 0x0, 0x3, 0x0, 0x10001, 0x2, 0x0, 0x6, 0x6, 0x3, 0x80000000, 0xfdffffff, 0x5a3, 0x2, 0x84, 0x100, 0x5, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x6, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8000, 0x2008da0, 0x1fc, 0x3, 0x4]}})
poll(&(0x7f0000000000), 0x20000000000000b5, 0x9)
r0 = socket$inet6(0xa, 0x1, 0x8010000000000084)
sendto$inet6(r0, &(0x7f0000000080)="9e7121c8efc8", 0x6, 0x4880, &(0x7f0000000180)={0xa, 0x4e20, 0x7, @local, 0x2}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000004cc0)=[{{&(0x7f0000000040)={0xa, 0x4e1e, 0x1ff, @mcast2, 0x401}, 0x1c, &(0x7f00000001c0)=[{&(0x7f00000003c0)="f5", 0x1}], 0x1}}, {{&(0x7f0000000480)={0xa, 0x4e24, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8e}, 0x1c, &(0x7f0000000d80)=[{&(0x7f0000000100)="6ffbf64655b9892c00ea", 0xa}], 0x1}}], 0x2, 0x40)
shutdown(r0, 0x1)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x4e24, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}, 0x3, 0x1, 0x3bf8580d, 0x0, 0xb3550aa4ba878396, 0x2}, 0x9c)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
write$tun(r1, &(0x7f0000000000)=ANY=[], 0x340a)
lseek(r1, 0xffffffffffffffff, 0x1)
ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f0000000000))
ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f00000000c0))

769.882645ms ago: executing program 2 (id=3066):
ioprio_set$pid(0x2, 0x0, 0x0) (async)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) (async)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x4000004) (async)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x1, 0x0, 0xb47, 0x7, 0x0, 0x80000001, 0x3}, 0x0)
r2 = socket$inet_sctp(0x2, 0x5, 0x84) (async, rerun: 32)
r3 = openat$drirender128(0xffffffffffffff9c, 0x0, 0x20000, 0x0) (rerun: 32)
ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r3, 0xc02064cc, &(0x7f00000001c0)={0x0, 0x0, 0xd, 0xc812, 0x5}) (async)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e24, @broadcast}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}], 0x20) (async)
setpriority(0x2, 0x0, 0x0) (async, rerun: 64)
r4 = socket$kcm(0x10, 0x2, 0x0) (async, rerun: 64)
r5 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r5, &(0x7f0000000180)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e22d991000000000000a80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff0000000200000000", 0x58}], 0x1) (async)
sendmsg$nl_netfilter(r5, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x18, 0x10, 0x5, 0x301, 0x70bd25, 0x25dfdbfc, {0xa, 0x0, 0x8}, [@typed={0x4, 0x76}]}, 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async)
sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x21, &(0x7f0000000140)=[{&(0x7f00000004c0)="d8000000190081154e81f782db4cb904021d0800fd02fe02e8fe50a10a000548258848000c600e41b0000900ac00080325000000040015000a00ff150048035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667daffffffffff1f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5b7276505de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000001008af26c8b7b55f4d2a6823a45", 0xd8}], 0x1}, 0x0)

639.787463ms ago: executing program 2 (id=3067):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000016000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000140)="43a479a40f090f58cc0fc77f4166b9800000c00f326635000800000f30b0ba610000b8d97591f666efba4100ed660f13835000672e0f300f0da80000", 0x3c}], 0x1, 0x25, &(0x7f0000000180), 0x0) (async)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0xc9a9c042ad77c5e5)
lsetxattr$security_capability(&(0x7f0000002580)='./file0\x00', &(0x7f00000025c0), 0x0, 0x0, 0x1) (async)
write$binfmt_elf32(r3, &(0x7f0000000940)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x6, 0x9e, 0xd, 0x0, 0x2, 0x3, 0x9, 0x2ca, 0x38, 0x25e, 0x404, 0x6edf, 0x20, 0x4, 0xfff8, 0x3ff, 0x200}, [{0x6474e551, 0x2714, 0xf20c, 0x8, 0x100, 0x6, 0x3, 0x8}, {0x4, 0x7fffffff, 0x2a8, 0x7fff, 0x6, 0x4, 0x6f9b, 0xb}, {0x70000000, 0xfffffffe, 0x5, 0x7, 0x9, 0x6f1, 0xbe, 0xc30}, {0x60000000, 0x5, 0x8cd2, 0x36, 0x6, 0x2, 0x7fffffff, 0x1ff}]}, 0xb8)
close(r3) (async)
execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000008000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f00000003c0)="0f0d51f40f01d10fc75800f30fc73600102ed5c01dc0000000008ec0640f017400aa66b9e408000066b81f6269e766ba000000000f309c0c0cb8d09bbc8966efbafc0cedba4300ba210066ed3626f00fc70d", 0x52}], 0x1, 0x41, 0x0, 0x0) (async)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

565.39281ms ago: executing program 1 (id=3068):
setsockopt$inet_sctp6_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x24, &(0x7f0000001a00), &(0x7f0000001a40)=0x4)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x6, 0x31, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000000)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9\xbe\\', 0x0)
pwrite64(r0, &(0x7f00000008c0)='/', 0x1, 0x0)
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0)
lseek(r0, 0x0, 0x4)
sendfile(r0, r0, &(0x7f00000001c0), 0x7fa)
symlink(&(0x7f0000001000)='./file0\x00', &(0x7f00000000c0)='./file0\x00')
mknodat$null(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file0\x00', 0x1000, 0x103) (fail_nth: 4)
openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0)

431.566025ms ago: executing program 2 (id=3069):
setrlimit(0x2, &(0x7f0000000000)={0x0, 0x2400000})
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f00000047c0)={0x0, 0xffffffffffffff58, &(0x7f00000005c0)=[{&(0x7f0000000040)={0x18, 0x7a, 0x601, 0x4000000, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1, 0x0, 0x0, 0x2004c091}, 0x0)
r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0)
r2 = syz_open_dev$sndctrl(&(0x7f00000003c0), 0xec2, 0x100)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000400))
ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000001180)=0x2000000)
unshare(0xc040400)
r3 = creat(&(0x7f00000016c0)='./file0\x00', 0x63)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001a40)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x0, 0x0, r3}, 0x68)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r1, 0x0)
writev(r3, &(0x7f0000000380)=[{&(0x7f0000000040)="a665896b1003999c9620b1939acc232799c736fd692fbf12343812517af2b46558534e58018ec5db86538f6590fe0ae47a91466fd9417fc53ba2ef926dbbc88533ccff3f488c8c8e08892d43578c16d6de7566b8335028ead997884886ff11cdc03863a354adb947ed5402f6754ed4b1416930f1fdd70529a194933460b764014746070c6e86d2a80399b277f646f9c7bab3e927dc1ac8d1b201f754fe2295d5e2c8be21c218d27150659f4128615e817ca3bfc8e500018b5f386f7d4f3183bbac2ee75878b1a9c94bd71c1548fb897ffb00e991dc6325c5841f00dcdf632d292ff50a3fcf17527388e8760597d266f7", 0xf0}, {&(0x7f0000000140)="da145a67de3509e9ac6e660a3b10673846a4f8f03ba55de4f48bf25a5032395c07252b459a33ee4f4c6c3d4c603f758064c4936101f76b58b1794ccddf5de56a492164aa235b7d9df243cf077c383589c016a84aa712afbc4109745afe6cc9a084d6d5d590e16fa8000e69a11aab3ef46910153f7179f93ac2fdd0c83c38577374a45f1e8b6eef41d5604a62045596e2cfefed39969500320d61deedbe4ecfb3ac43f0d03083b6786e00999cd5a93cbb87df568ace1ad82c9096aad5ee2a95529e5ecc717d87", 0xc6}, {&(0x7f0000000240)="7f8dca22c99e1071c41a417f8caebf8189760753747925338214dcf4150d64a99e8c52d3dc3f5af78d274e47d00d4db0c81f829527c7c1da553b38a4888228c069dccbc21029df5d16348149c12f8b0f86206d14d02c20b63c69701802f453794e597bc91fa0c73a0118477cb170051f07b9c61670a0b81e4ac404da656c1f3da523b5d3", 0x84}, {&(0x7f0000000300)="5b359786f07e9cb51778e2a85012a85a4f03a3051b4a746cf252d6650163f634b18770716bb1920243cd31903be1e13b5e98cf2873aa8c4ab4b5b135219086af74036a3aa5dffe54d1d36b2fdd969b05bb106eb37438", 0x56}], 0x4)
socket$netlink(0x10, 0x3, 0x7)

0s ago: executing program 1 (id=3070):
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406d0422c200000000000109022d0001010080320904000002030000000921110100012223000905810340000a00000905020340"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022230000000600ff0900a10185020901150026ff0075089508810209029512910209039503b102c0"], 0x0}, 0x0)
openat$nvram(0xffffffffffffff9c, &(0x7f0000000c80), 0x283, 0x0)
openat$nvram(0xffffffffffffff9c, &(0x7f0000000d00), 0x0, 0x0)
syz_usb_ep_read(r0, 0x2, 0x0, 0x0)

kernel console output (not intermixed with test programs):

pe 25 has an invalid length.
[  565.420418][T15768] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2726'.
[  565.513418][T15771] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  565.523271][T15773] xt_hashlimit: size too large, truncated to 1048576
[  565.787342][ T5697] usb 4-1: new high-speed USB device number 22 using dummy_hcd
[  565.949423][ T5697] usb 4-1: Using ep0 maxpacket: 8
[  565.957214][ T5697] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a
[  565.969029][ T5697] usb 4-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config
[  565.982124][ T5697] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  565.994413][ T5697] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  566.006778][ T5697] usb 4-1: config 0 descriptor??
[  566.230137][ T5697] usb 4-1: USB disconnect, device number 22
[  566.702824][T15788] PKCS7: Unknown OID: [4] 2.19.106.94.68.126.960(bad)
[  566.710849][T15788] PKCS7: Only support pkcs7_signedData type
[  566.938420][T15803] lo: entered allmulticast mode
[  567.078267][ T5697] usb 4-1: new high-speed USB device number 23 using dummy_hcd
[  567.238054][ T5697] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  567.257996][ T5697] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  567.270271][ T5697] usb 4-1: config 0 descriptor??
[  567.284789][ T5697] cp210x 4-1:0.0: cp210x converter detected
[  567.404747][T15818] random: crng reseeded on system resumption
[  567.694402][ T5697] cp210x 4-1:0.0: failed to get vendor val 0x000e size 3: -32
[  567.724821][ T5697] usb 4-1: cp210x converter now attached to ttyUSB0
[  567.784806][T15802] lo: left allmulticast mode
[  567.912551][T14983] Bluetooth: hci5: unexpected event 0x03 length: 1 < 11
[  567.922479][ T5697] usb 4-1: USB disconnect, device number 23
[  567.952838][ T5697] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  567.975889][ T5697] cp210x 4-1:0.0: device disconnected
[  568.008817][T14548] usb 1-1: new high-speed USB device number 19 using dummy_hcd
[  568.191884][T14548] usb 1-1: New USB device found, idVendor=056a, idProduct=0045, bcdDevice= 0.00
[  568.219269][T14548] usb 1-1: config 0 has no interfaces?
[  568.232583][T14548] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  568.268796][T14548] usb 1-1: config 0 descriptor??
[  568.324505][T15851] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer.
[  568.416760][T15856] random: crng reseeded on system resumption
[  568.516359][T15835] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  568.541695][T15835] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  568.580160][T14548] usb 1-1: USB disconnect, device number 19
[  568.587254][ T5697] usb 2-1: new high-speed USB device number 26 using dummy_hcd
[  568.767830][ T5697] usb 2-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00
[  568.785083][ T5697] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  568.795805][ T5697] usb 2-1: config 0 has no interfaces?
[  568.807364][ T5697] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  568.822211][ T5697] usb 2-1: config 0 descriptor??
[  569.006986][   T24] usb 4-1: new high-speed USB device number 24 using dummy_hcd
[  569.074567][T15868] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3482940618 (6965881236 ns) > initial count (504378442 ns). Using initial count to start timer.
[  569.096965][ T5697] usb 3-1: new high-speed USB device number 10 using dummy_hcd
[  569.107005][T14548] usb 1-1: new high-speed USB device number 20 using dummy_hcd
[  569.128037][ T5723] usb 2-1: USB disconnect, device number 26
[  569.178762][   T24] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00
[  569.189901][   T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  569.201392][   T24] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[  569.214984][   T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  569.258828][ T5697] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08
[  569.274420][ T5697] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  569.278703][T14548] usb 1-1: Using ep0 maxpacket: 8
[  569.292734][T14548] usb 1-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice= 1.08
[  569.303706][T14548] usb 1-1: config index 0 descriptor too short (expected 72, got 36)
[  569.305065][ T5697] usb 3-1: config 0 descriptor??
[  569.312133][T14548] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6
[  569.319763][T14548] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  569.338573][T14548] usb 1-1: Product: syz
[  569.342813][T14548] usb 1-1: Manufacturer: syz
[  569.347592][T14548] usb 1-1: SerialNumber: syz
[  569.490242][T15873] syz_tun: entered allmulticast mode
[  569.591327][T15866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  569.602839][T15866] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  569.624707][ T5697] udl 3-1:0.0: [drm] Unrecognized vendor firmware descriptor
[  569.636023][ T5697] [drm:udl_init] *ERROR* Selecting channel failed
[  569.653882][T14548] usb 1-1: USB disconnect, device number 20
[  569.665791][ T5697] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 1
[  569.674372][ T5697] [drm] Initialized udl on minor 1
[  569.695565][ T5697] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9
[  569.736164][ T5697] udl 3-1:0.0: [drm] Cannot find any crtc or sizes
[  569.742930][ T5723] usb 2-1: new high-speed USB device number 27 using dummy_hcd
[  569.757861][T13882] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9
[  569.772795][ T5697] usb 3-1: USB disconnect, device number 10
[  569.781879][T13882] udl 3-1:0.0: [drm] Cannot find any crtc or sizes
[  569.876988][ T5723] usb 2-1: device descriptor read/64, error -71
[  570.019228][   T24] ttusb_dec_send_command: command bulk message failed: error -71
[  570.043071][   T24] ttusb-dec 4-1:1.0: probe with driver ttusb-dec failed with error -71
[  570.064644][   T24] usb 4-1: USB disconnect, device number 24
[  570.119917][ T5723] usb 2-1: new high-speed USB device number 28 using dummy_hcd
[  570.271236][ T5723] usb 2-1: device descriptor read/64, error -71
[  570.417220][ T5723] usb usb2-port1: attempt power cycle
[  570.757117][ T5723] usb 2-1: new high-speed USB device number 29 using dummy_hcd
[  570.777785][ T5723] usb 2-1: device descriptor read/8, error -71
[  571.017019][ T5723] usb 2-1: new high-speed USB device number 30 using dummy_hcd
[  571.038517][ T5723] usb 2-1: device descriptor read/8, error -71
[  571.157310][ T5723] usb usb2-port1: unable to enumerate USB device
[  571.407130][ T5723] usb 1-1: new high-speed USB device number 21 using dummy_hcd
[  571.463461][T15909] fuse: Unknown parameter 'fê‚0x0000000000000008'
[  571.567334][ T5723] usb 1-1: Using ep0 maxpacket: 16
[  571.580042][ T5723] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00
[  571.596119][ T5723] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  571.607788][ T5723] usb 1-1: config 0 interface 0 has no altsetting 0
[  571.614591][ T5723] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  571.626359][ T5723] usb 1-1: config 0 descriptor??
[  571.930395][T15921] input: syz1 as /devices/virtual/input/input70
[  572.497183][T14548] usb 5-1: new high-speed USB device number 123 using dummy_hcd
[  572.530946][T15875] syz_tun: left allmulticast mode
[  572.669149][T14548] usb 5-1: unable to get BOS descriptor or descriptor too short
[  572.695678][T14548] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40
[  572.726017][T14548] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  572.741934][T14548] usb 5-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[  572.773953][T14548] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  572.806675][T14548] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  572.826020][T14548] usb 5-1: Product: �㵕푖芊핥₥䬂᷆᢫䕆踂�篳�ⓡ⠎ꩠ䎥꼔솊袠墦徽�䈺瀊겔웟�榩�藗�氰㖦➈��쮅懩�➚觯蹒놨奙
[  572.856315][T14548] usb 5-1: SerialNumber: syz
[  572.917083][T15940] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2775'.
[  572.927367][T15940] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2775'.
[  572.965890][T15940] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2775'.
[  572.975855][ T3301] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  572.986200][ T3301] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  573.000633][T15940] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2775'.
[  573.011456][ T3301] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  573.026376][ T3301] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  573.186481][T14548] usb 5-1: 2:1 : no or invalid class specific endpoint descriptor
[  573.207659][T14548] usb 5-1: 2:1 : unknown format tag 0x4 is detected.  processed as MPEG.
[  573.216416][T14548] usb 5-1: found format II with max.bitrate = 4, frame size=7372
[  573.245661][T14548] usb 5-1: parse_audio_format_rates_v2v3(): unable to retrieve number of sample rates (clock 0)
[  573.487163][ T5683] usb 4-1: new high-speed USB device number 25 using dummy_hcd
[  573.525688][T14548] usb 5-1: USB disconnect, device number 123
[  573.730950][ T5683] usb 4-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01
[  573.789578][ T5683] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  573.817157][ T5683] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  573.849776][ T6313] udevd[6313]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  573.926671][ T5683] as10x_usb: device has been detected
[  573.957124][ T5683] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan)
[  574.038569][T15960] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2779'.
[  574.116517][T15960] netlink: 'syz.1.2779': attribute type 1 has an invalid length.
[  574.131351][ T5723] usbhid 1-1:0.0: can't add hid device: -71
[  574.140773][T15950] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  574.156813][ T5723] usbhid 1-1:0.0: probe with driver usbhid failed with error -71
[  574.187126][T14548] usb 5-1: new high-speed USB device number 124 using dummy_hcd
[  574.195761][ T5683] usb 4-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)...
[  574.241323][ T5723] usb 1-1: USB disconnect, device number 21
[  574.284645][T15950] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  574.376631][T14548] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a
[  574.409153][T14548] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  574.424232][T14548] usb 5-1: Product: syz
[  574.428918][T14548] usb 5-1: Manufacturer: syz
[  574.433854][T14548] usb 5-1: SerialNumber: syz
[  574.439279][T15950] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[  574.482570][T14548] usb 5-1: config 0 descriptor??
[  574.500940][T15950] block device autoloading is deprecated and will be removed.
[  574.595639][T15960] 8021q: adding VLAN 0 to HW filter on device bond1
[  574.606822][ T5683] as10x_usb: error during firmware upload part1
[  574.637966][ T5683] Registered device Abilis Systems DVB-Titan
[  574.724261][T15962] bond1: (slave gretap2): making interface the new active one
[  574.790949][T15962] bond1: (slave gretap2): Enslaving as an active interface with an up link
[  574.866819][T15970] netlink: 'syz.0.2781': attribute type 25 has an invalid length.
[  574.904569][T15970] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2781'.
[  574.956301][T14548] usb 5-1: Firmware version (0.0) predates our first public release.
[  574.994463][T14548] usb 5-1: Please update to version 0.2 or newer
[  575.010506][T14548] usb 5-1: Firmware: build 
[  575.326485][T15986] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2785'.
[  575.400305][T15986] bridge0: port 3(vlan2) entered disabled state
[  575.406977][T15986] bridge0: port 2(bridge_slave_1) entered disabled state
[  575.415689][T15986] bridge0: port 1(bridge_slave_0) entered disabled state
[  575.427407][T14548] usb 5-1: USB disconnect, device number 124
[  576.057231][ T5723] usb 3-1: new low-speed USB device number 11 using dummy_hcd
[  576.073343][    C0] Unknown status report in ack skb
[  576.084082][T16011] loop4: detected capacity change from 0 to 2
[  576.094019][ T6313] buffer_io_error: 32 callbacks suppressed
[  576.094035][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.119193][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.140474][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.159224][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.175072][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.197126][ T5723] usb 3-1: device descriptor read/64, error -71
[  576.202841][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.217961][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.227902][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.238397][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.249338][ T6313] Buffer I/O error on dev loop4, logical block 0, async page read
[  576.378177][T16015] netlink: 'syz.1.2792': attribute type 25 has an invalid length.
[  576.418093][T16015] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2792'.
[  576.437586][ T5723] usb 3-1: new low-speed USB device number 12 using dummy_hcd
[  576.587060][ T5723] usb 3-1: device descriptor read/64, error -71
[  576.687052][ T5697] usb 1-1: new high-speed USB device number 22 using dummy_hcd
[  576.697865][ T5723] usb usb3-port1: attempt power cycle
[  576.778570][T13882] usb 2-1: new high-speed USB device number 31 using dummy_hcd
[  576.837184][ T5697] usb 1-1: Using ep0 maxpacket: 32
[  576.851298][ T5697] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  576.869522][ T5697] usb 1-1: config 0 has an invalid interface number: 67 but max is 0
[  576.878830][ T5697] usb 1-1: config 0 has no interface number 0
[  576.892665][ T5697] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  576.901528][ T5697] usb 1-1: Product: syz
[  576.905787][ T5697] usb 1-1: Manufacturer: syz
[  576.911156][ T5697] usb 1-1: SerialNumber: syz
[  576.920562][ T5697] usb 1-1: config 0 descriptor??
[  576.938100][T13882] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00
[  576.971117][T13882] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3
[  576.985180][T13882] usb 2-1: Product: syz
[  576.991761][T13882] usb 2-1: SerialNumber: syz
[  577.012429][T13882] usb 2-1: config 0 descriptor??
[  577.038272][ T5723] usb 3-1: new low-speed USB device number 13 using dummy_hcd
[  577.059090][ T5723] usb 3-1: device descriptor read/8, error -71
[  577.230407][T13882] hso 2-1:0.0: Failed to find BULK eps
[  577.270799][T16028] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2797'.
[  577.317042][ T5723] usb 3-1: new low-speed USB device number 14 using dummy_hcd
[  577.341186][ T5697] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
[  577.353492][ T5697] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  577.365156][ T5723] usb 3-1: device descriptor read/8, error -71
[  577.433013][T16019] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2794'.
[  577.446651][T14548] usb 2-1: USB disconnect, device number 31
[  577.477485][ T5723] usb usb3-port1: unable to enumerate USB device
[  578.007125][T16033] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2799'.
[  578.064677][T16036] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2800'.
[  578.076555][T16036] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2800'.
[  578.761825][T16048] netlink: 'syz.1.2804': attribute type 25 has an invalid length.
[  578.769928][T16048] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2804'.
[  578.966732][T16053] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2806'.
[  579.208102][T16053] bridge1: port 1(veth3) entered blocking state
[  579.218577][T16053] bridge1: port 1(veth3) entered disabled state
[  579.225366][T16053] veth3: entered allmulticast mode
[  579.233277][T16053] veth3: entered promiscuous mode
[  579.277937][T16056] bridge1: port 2(veth0_to_bond) entered blocking state
[  579.308402][T16056] bridge1: port 2(veth0_to_bond) entered disabled state
[  579.325267][T16056] veth0_to_bond: entered allmulticast mode
[  579.334371][T16056] veth0_to_bond: entered promiscuous mode
[  579.349202][T16017] xfrm0: Caught tx_queue_len zero misconfig
[  579.423181][T16065] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2808'.
[  579.435906][T16065] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2808'.
[  579.452236][T16065] netlink: 'syz.4.2808': attribute type 13 has an invalid length.
[  579.460490][T16065] netlink: 'syz.4.2808': attribute type 14 has an invalid length.
[  579.518087][T16051] netlink: 136 bytes leftover after parsing attributes in process `syz.1.2805'.
[  579.718978][ T5697] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61
[  579.741863][ T5697] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -61
[  579.907337][T14548] usb 5-1: new high-speed USB device number 125 using dummy_hcd
[  579.986991][T13882] usb 3-1: new high-speed USB device number 15 using dummy_hcd
[  580.057922][T14548] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00
[  580.070526][T14548] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  580.078809][T14548] usb 5-1: Product: syz
[  580.083040][T14548] usb 5-1: Manufacturer: syz
[  580.088710][T14548] usb 5-1: SerialNumber: syz
[  580.141402][T13882] usb 3-1: unable to get BOS descriptor or descriptor too short
[  580.149714][T13882] usb 3-1: New USB device found, idVendor=041e, idProduct=323b, bcdDevice= 0.40
[  580.160748][T13882] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  580.173416][T13882] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7
[  580.187111][T13882] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  580.195326][T13882] usb 3-1: Product: syz
[  580.199784][T13882] usb 3-1: Manufacturer: syz
[  580.204447][T13882] usb 3-1: SerialNumber: syz
[  580.423974][T13882] usb 3-1: cannot find UAC_HEADER
[  580.486733][T13882] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -22
[  580.516233][T13882] usb 3-1: USB disconnect, device number 15
[  580.555375][ T7049] udevd[7049]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  580.765616][T14548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPROTO
[  580.798320][T14548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPROTO
[  580.839230][T14548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO
[  580.860967][T14548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED....
[  580.873427][T14548] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED
[  580.886475][T14548] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71
[  580.907804][T14548] usb 5-1: USB disconnect, device number 125
[  581.005847][T13882] usb 1-1: USB disconnect, device number 22
[  581.139006][T16084] netlink: 'syz.0.2815': attribute type 25 has an invalid length.
[  581.149362][T16084] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2815'.
[  581.299063][T16087] netlink: 'syz.0.2816': attribute type 7 has an invalid length.
[  581.329564][T13882] usb 4-1: USB disconnect, device number 25
[  581.363695][T16087] netlink: 'syz.0.2816': attribute type 7 has an invalid length.
[  581.378020][ T3337] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  581.393174][ T3337] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  581.412786][ T3337] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  581.432311][ T3337] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  581.540192][T16095] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2817'.
[  581.601685][T13882] Unregistered device Abilis Systems DVB-Titan
[  581.614372][T13882] as10x_usb: device has been disconnected
[  581.837180][ T5697] usb 5-1: new high-speed USB device number 126 using dummy_hcd
[  581.906999][T14548] usb 1-1: new high-speed USB device number 23 using dummy_hcd
[  581.958651][T13882] usb 4-1: new high-speed USB device number 26 using dummy_hcd
[  581.997705][ T5683] usb 3-1: new high-speed USB device number 16 using dummy_hcd
[  582.009693][ T5697] usb 5-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=4e.40
[  582.028725][ T5697] usb 5-1: config 127 has an invalid interface number: 138 but max is 0
[  582.047291][ T5697] usb 5-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config
[  582.067223][ T5697] usb 5-1: config 127 has no interface number 0
[  582.067420][T14548] usb 1-1: device descriptor read/64, error -71
[  582.084195][ T5697] usb 5-1: config 127 interface 138 altsetting 0 has an endpoint descriptor with address 0xD7, changing to 0x87
[  582.108796][ T5697] usb 5-1: config 127 interface 138 altsetting 0 endpoint 0x87 has invalid maxpacket 16747, setting to 1024
[  582.124742][ T5697] usb 5-1: config 127 interface 138 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0
[  582.135190][ T5697] usb 5-1: config 127 interface 138 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  582.148674][T13882] usb 4-1: Using ep0 maxpacket: 16
[  582.154641][T13882] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00
[  582.168859][T13882] usb 4-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  582.180848][T13882] usb 4-1: config 0 interface 0 has no altsetting 0
[  582.187762][T13882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  582.196006][ T5697] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  582.204180][ T5697] usb 5-1: Product: syz
[  582.205051][ T5683] usb 3-1: Using ep0 maxpacket: 16
[  582.209942][ T5697] usb 5-1: Manufacturer: syz
[  582.218552][ T5683] usb 3-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73
[  582.222086][ T5697] usb 5-1: SerialNumber: syz
[  582.233391][T13882] usb 4-1: config 0 descriptor??
[  582.235779][ T5683] usb 3-1: config 0 has an invalid interface number: 34 but max is 0
[  582.249743][ T5683] usb 3-1: config 0 has no interface number 0
[  582.255940][ T5683] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023
[  582.267640][ T5683] usb 3-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80
[  582.284956][ T5683] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  582.293647][ T5683] usb 3-1: Product: syz
[  582.299843][ T5683] usb 3-1: Manufacturer: syz
[  582.304788][ T5683] usb 3-1: SerialNumber: syz
[  582.313714][ T5683] usb 3-1: config 0 descriptor??
[  582.319993][T16102] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22
[  582.327476][T14548] usb 1-1: new high-speed USB device number 24 using dummy_hcd
[  582.337092][T16102] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22
[  582.357022][ T1552] usb 2-1: new high-speed USB device number 32 using dummy_hcd
[  582.477077][T14548] usb 1-1: device descriptor read/64, error -71
[  582.505629][ T5697] usb 5-1: probing VID:PID(0424:012C)   
[  582.513840][ T5697] usb 5-1: vub300 testing UNKNOWN EndPoint(0) 87
[  582.521903][ T5697] usb 5-1: vub300 ignoring EndPoint(0) 87
[  582.528646][ T1552] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00
[  582.530894][ T5697] usb 5-1: vub300 testing UNKNOWN EndPoint(1) 09
[  582.545449][ T5697] usb 5-1: vub300 ignoring EndPoint(1) 09
[  582.551761][ T5697] usb 5-1: Could not find two sets of bulk-in/out endpoint pairs
[  582.554011][ T1552] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3
[  582.568080][ T1552] usb 2-1: Product: syz
[  582.572336][ T1552] usb 2-1: SerialNumber: syz
[  582.584328][T16102] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22
[  582.592452][ T5697] vub300 5-1:127.138: probe with driver vub300 failed with error -22
[  582.593284][ T1552] usb 2-1: config 0 descriptor??
[  582.605709][T16102] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22
[  582.613541][T14548] usb usb1-port1: attempt power cycle
[  582.629913][ T1552] hso 2-1:0.0: Not our interface
[  582.638761][ T5697] usb 5-1: USB disconnect, device number 126
[  582.674380][T13882] mcp2221 0003:04D8:00DD.0025: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0
[  582.814494][ T5683] asix 3-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random
[  582.833338][T13882] usb 2-1: USB disconnect, device number 32
[  582.967271][T14548] usb 1-1: new high-speed USB device number 25 using dummy_hcd
[  583.008010][T14548] usb 1-1: device descriptor read/8, error -71
[  583.070922][T16094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  583.099097][T16094] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  583.115999][T16094] i2c i2c-1: unsupported multi-msg i2c transaction
[  583.129954][T13882] usb 4-1: USB disconnect, device number 26
[  583.215681][ T5683] asix 3-1:0.34 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61
[  583.227423][ T5683] asix 3-1:0.34: probe with driver asix failed with error -61
[  583.257578][T14548] usb 1-1: new high-speed USB device number 26 using dummy_hcd
[  583.278029][T14548] usb 1-1: device descriptor read/8, error -71
[  583.397696][T14548] usb usb1-port1: unable to enumerate USB device
[  583.435307][T16112] netlink: 'syz.1.2826': attribute type 25 has an invalid length.
[  583.444274][T16112] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2826'.
[  583.567177][T13855] usb 5-1: new high-speed USB device number 127 using dummy_hcd
[  583.723865][T13855] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08
[  583.753587][T13855] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  583.790470][T13855] usb 5-1: config 0 descriptor??
[  584.026717][T16108] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  584.068517][T16108] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  584.168134][T13855] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor
[  584.178146][T13855] [drm:udl_init] *ERROR* Selecting channel failed
[  584.222328][T13855] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 1
[  584.231476][T13855] [drm] Initialized udl on minor 1
[  584.244934][T13855] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9
[  584.254119][T16127] FAULT_INJECTION: forcing a failure.
[  584.254119][T16127] name failslab, interval 1, probability 0, space 0, times 0
[  584.267580][T13855] udl 5-1:0.0: [drm] Cannot find any crtc or sizes
[  584.282540][T13882] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9
[  584.293646][T16127] CPU: 0 UID: 0 PID: 16127 Comm: syz.3.2830 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  584.293674][T16127] Tainted: [L]=SOFTLOCKUP
[  584.293681][T16127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  584.293691][T16127] Call Trace:
[  584.293699][T16127]  <TASK>
[  584.293708][T16127]  dump_stack_lvl+0xe8/0x150
[  584.293745][T16127]  should_fail_ex+0x410/0x560
[  584.293769][T16127]  should_failslab+0xa8/0x100
[  584.293788][T16127]  kmem_cache_alloc_node_noprof+0xb3/0x620
[  584.293811][T16127]  ? kmem_cache_alloc_node_noprof+0x1f7/0x620
[  584.293834][T16127]  ? __alloc_skb+0x1db/0x7a0
[  584.293856][T16127]  ? __alloc_skb+0x1db/0x7a0
[  584.293883][T16127]  __alloc_skb+0x1db/0x7a0
[  584.293909][T16127]  tipc_buf_acquire+0x2b/0xe0
[  584.293936][T16127]  tipc_msg_build+0x911/0xf50
[  584.293971][T16127]  ? __pfx_tipc_msg_build+0x10/0x10
[  584.294000][T16127]  ? net_generic+0x1e/0x240
[  584.294021][T16127]  ? net_generic+0x1e/0x240
[  584.294044][T16127]  ? tipc_group_bc_cong+0x15f/0x210
[  584.294065][T16127]  tipc_send_group_bcast+0x7db/0xad0
[  584.294106][T16127]  ? __pfx_tipc_send_group_bcast+0x10/0x10
[  584.294130][T16127]  ? is_bpf_text_address+0x26/0x2b0
[  584.294165][T16127]  ? unwind_get_return_address+0x4d/0x90
[  584.294185][T16127]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  584.294210][T16127]  ? __pfx_woken_wake_function+0x10/0x10
[  584.294233][T16127]  ? look_up_lock_class+0x57/0x110
[  584.294265][T16127]  ? register_lock_class+0x31/0x2e0
[  584.294298][T16127]  __tipc_sendmsg+0x313/0x2b60
[  584.294341][T16127]  ? __pfx___tipc_sendmsg+0x10/0x10
[  584.294368][T16127]  ? process_measurement+0x443/0x1c10
[  584.294399][T16127]  ? process_measurement+0x443/0x1c10
[  584.294426][T16127]  ? aa_label_sk_perm+0x532/0x6e0
[  584.294455][T16127]  ? __pfx_aa_label_sk_perm+0x10/0x10
[  584.294473][T16127]  ? process_measurement+0x7b2/0x1c10
[  584.294502][T16127]  ? __lock_acquire+0x683/0x2cf0
[  584.294534][T16127]  ? __lock_acquire+0x683/0x2cf0
[  584.294583][T16127]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  584.294612][T16127]  ? tipc_sendmsg+0x47/0x70
[  584.294646][T16127]  ? __local_bh_enable_ip+0xd6/0x140
[  584.294674][T16127]  tipc_sendmsg+0x55/0x70
[  584.294705][T16127]  ? __pfx_tipc_sendmsg+0x10/0x10
[  584.294735][T16127]  sock_sendmsg_nosec+0x13a/0x180
[  584.294783][T16127]  ____sys_sendmsg+0x54e/0x850
[  584.294828][T16127]  ? __pfx_____sys_sendmsg+0x10/0x10
[  584.294872][T16127]  ? import_iovec+0x73/0xa0
[  584.294902][T16127]  ___sys_sendmsg+0x2a5/0x360
[  584.294931][T16127]  ? __lock_acquire+0x683/0x2cf0
[  584.294964][T16127]  ? __pfx____sys_sendmsg+0x10/0x10
[  584.295003][T16127]  ? kstrtouint+0x6e/0xe0
[  584.295063][T16127]  ? __fget_files+0x2a/0x420
[  584.295085][T16127]  ? __fget_files+0x3a2/0x420
[  584.295117][T16127]  __sys_sendmmsg+0x273/0x4d0
[  584.295156][T16127]  ? __pfx___sys_sendmmsg+0x10/0x10
[  584.295200][T16127]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  584.295237][T16127]  ? ksys_write+0x242/0x270
[  584.295265][T16127]  ? __pfx_ksys_write+0x10/0x10
[  584.295295][T16127]  __x64_sys_sendmmsg+0xa0/0xc0
[  584.295332][T16127]  do_syscall_64+0x166/0x520
[  584.295353][T16127]  ? trace_irq_disable+0x3b/0x140
[  584.295379][T16127]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  584.295402][T16127]  ? clear_bhb_loop+0x70/0xc0
[  584.295427][T16127]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  584.295459][T16127] RIP: 0033:0x7ff64159e0d9
[  584.295478][T16127] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  584.295495][T16127] RSP: 002b:00007ff64249f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  584.295518][T16127] RAX: ffffffffffffffda RBX: 00007ff641826090 RCX: 00007ff64159e0d9
[  584.295551][T16127] RDX: 0400000000000181 RSI: 00002000000030c0 RDI: 0000000000000003
[  584.295566][T16127] RBP: 00007ff64249f090 R08: 0000000000000000 R09: 0000000000000000
[  584.295580][T16127] R10: 9200000000000000 R11: 0000000000000246 R12: 0000000000000002
[  584.295594][T16127] R13: 00007ff641826128 R14: 00007ff641826090 R15: 00007ff64194fa48
[  584.295628][T16127]  </TASK>
[  584.718662][T13855] usb 5-1: USB disconnect, device number 127
[  584.849718][ T5683] usb 3-1: USB disconnect, device number 16
[  585.157251][T13882] usb 1-1: new high-speed USB device number 27 using dummy_hcd
[  585.340180][T13882] usb 1-1: unable to get BOS descriptor or descriptor too short
[  585.372665][T13882] usb 1-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75
[  585.405606][T13882] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2
[  585.432253][T13882] usb 1-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[  585.450603][T13882] usb 1-1: config 1 interface 0 has no altsetting 1
[  585.475940][T13882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  585.486418][T13882] usb 1-1: Product: 䪂἗㦇졵㘥姴ꕩౙ�倬͖ࢦᙌ�砑䅴牘㡭켸뷶�ጰ曤二앢䟂푤ك�䋛�뙮
[  585.512646][T13882] usb 1-1: Manufacturer: ࡃ
[  585.520993][T13882] usb 1-1: SerialNumber: 癤裥랆鸑涂覈௤敡䋺ᔗ쨨렲�ꡆ
[  585.564845][T13882] smsusb:smsusb_probe: board id=8, interface number 0
[  585.773421][T13882] smsusb:smsusb_probe: usb_set_interface failed, rc -71
[  585.801840][T13882] smsusb 1-1:1.0: probe with driver smsusb failed with error -71
[  585.825739][T13882] usb 1-1: USB disconnect, device number 27
[  586.022589][T16151] netlink: 'syz.2.2837': attribute type 25 has an invalid length.
[  586.030959][T16151] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2837'.
[  587.086956][    T0] NOHZ tick-stop error: local softirq work is pending, handler #2c2!!!
[  587.127289][    C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
[  587.229271][T16167] syzkaller0: entered promiscuous mode
[  587.621854][   T30] audit: type=1326 audit(1787259525.732:3011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16173 comm="syz.2.2844" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb9c479e0d9 code=0x0
[  587.685064][   T30] audit: type=1326 audit(1787259525.792:3012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16175 comm="syz.0.2846" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ffac939e0d9 code=0x0
[  587.996949][ T1552] usb 1-1: new high-speed USB device number 28 using dummy_hcd
[  588.137012][ T1552] usb 1-1: device descriptor read/64, error -71
[  588.408214][ T1552] usb 1-1: new high-speed USB device number 29 using dummy_hcd
[  588.567173][ T1552] usb 1-1: device descriptor read/64, error -71
[  588.682014][T16188] input: syz1 as /devices/virtual/input/input71
[  588.691710][T14548] usb 2-1: new high-speed USB device number 33 using dummy_hcd
[  588.701799][ T1552] usb usb1-port1: attempt power cycle
[  588.877928][T14548] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08
[  588.917609][T14548] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  588.968430][T14548] usb 2-1: config 0 descriptor??
[  589.059404][ T1552] usb 1-1: new high-speed USB device number 30 using dummy_hcd
[  589.097851][ T1552] usb 1-1: device descriptor read/8, error -71
[  589.247322][T13855] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[  589.346114][T16181] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  589.347423][ T1552] usb 1-1: new high-speed USB device number 31 using dummy_hcd
[  589.361351][T16181] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  589.387871][ T1552] usb 1-1: device descriptor read/8, error -71
[  589.406920][T13855] usb 5-1: Using ep0 maxpacket: 16
[  589.423145][T13855] usb 5-1: unable to get BOS descriptor or descriptor too short
[  589.446966][T13855] usb 5-1: New USB device found, idVendor=0b95, idProduct=2790, bcdDevice=9c.c9
[  589.464312][T13855] usb 5-1: config 16 has an invalid interface number: 32 but max is 0
[  589.476407][T13855] usb 5-1: config 16 has no interface number 0
[  589.490958][T13855] usb 5-1: config 16 interface 32 has no altsetting 0
[  589.501371][ T1552] usb usb1-port1: unable to enumerate USB device
[  589.513813][T13855] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  589.521246][T16181] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  589.537117][T13855] usb 5-1: Product: syz
[  589.541376][T13855] usb 5-1: Manufacturer: syz
[  589.548791][T13855] usb 5-1: SerialNumber: syz
[  589.570212][T16181] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  589.603239][T16181] fuse: Bad value for 'fd'
[  589.614040][T14548] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor
[  589.636395][T14548] [drm:udl_init] *ERROR* Selecting channel failed
[  589.696308][T14548] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 1
[  589.723059][T14548] [drm] Initialized udl on minor 1
[  589.738295][T14548] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9
[  589.770516][T14548] udl 2-1:0.0: [drm] Cannot find any crtc or sizes
[  589.799015][T14548] usb 2-1: USB disconnect, device number 33
[  589.806360][ T1552] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed
[  589.868954][ T1552] udl 2-1:0.0: [drm] Cannot find any crtc or sizes
[  589.874732][T13855] usb 5-1: USB disconnect, device number 2
[  590.237034][ T1552] usb 3-1: new high-speed USB device number 17 using dummy_hcd
[  590.417038][ T1552] usb 3-1: Using ep0 maxpacket: 16
[  590.434376][ T1552] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  590.456209][ T1552] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  590.487071][ T1552] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  590.506953][ T1552] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  590.527011][ T1552] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  590.545755][T16206] netlink: 830 bytes leftover after parsing attributes in process `syz.4.2854'.
[  590.558269][ T1552] usb 3-1: config 0 descriptor??
[  590.787775][T16204] xt_hashlimit: size too large, truncated to 1048576
[  590.804059][T14983] Bluetooth: hci4: ACL packet for unknown connection handle 200
[  590.902476][T16214] bridge0: port 1(bridge_slave_0) entered disabled state
[  590.928284][T16214] bridge_slave_0 (unregistering): left allmulticast mode
[  590.935604][T16214] bridge_slave_0 (unregistering): left promiscuous mode
[  590.945934][T16214] bridge0: port 1(bridge_slave_0) entered disabled state
[  591.250339][T16220] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2858'.
[  591.369274][T16226] Cannot find del_set index 4 as target
[  591.482068][T16225] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2857'.
[  591.505200][ T1552] usbhid 3-1:0.0: can't add hid device: -71
[  591.526687][ T1552] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[  591.585762][ T1552] usb 3-1: USB disconnect, device number 17
[  591.620390][T16220] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2858'.
[  591.904365][T16231] warn_alloc: 1 callbacks suppressed
[  591.904379][T16231] syz.3.2861: vmalloc error: size 4096, failed to allocate pages, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1
[  591.986050][T16231] CPU: 0 UID: 0 PID: 16231 Comm: syz.3.2861 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  591.986086][T16231] Tainted: [L]=SOFTLOCKUP
[  591.986095][T16231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  591.986108][T16231] Call Trace:
[  591.986116][T16231]  <TASK>
[  591.986126][T16231]  dump_stack_lvl+0xe8/0x150
[  591.986161][T16231]  warn_alloc+0x24c/0x270
[  591.986197][T16231]  ? __pfx_warn_alloc+0x10/0x10
[  591.986226][T16231]  ? trace_kmalloc+0x2a/0xf0
[  591.986259][T16231]  ? alloc_pages_mpol+0x24a/0x390
[  591.986293][T16231]  __vmalloc_node_range_noprof+0x1175/0x1730
[  591.986349][T16231]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  591.986378][T16231]  ? futex_unqueue+0x22/0x240
[  591.986412][T16231]  ? futex_unqueue+0x22/0x240
[  591.986448][T16231]  ? bpf_prog_alloc_no_stats+0x47/0x4f0
[  591.986479][T16231]  __vmalloc_noprof+0xd2/0x120
[  591.986524][T16231]  ? bpf_prog_alloc_no_stats+0x47/0x4f0
[  591.986577][T16231]  bpf_prog_alloc_no_stats+0x47/0x4f0
[  591.986619][T16231]  ? bpf_prog_alloc+0x2a/0x1a0
[  591.986656][T16231]  bpf_prog_alloc+0x3c/0x1a0
[  591.986693][T16231]  bpf_prog_load+0x7f8/0x1c00
[  591.986739][T16231]  ? __pfx_bpf_prog_load+0x10/0x10
[  591.986797][T16231]  __sys_bpf+0xd0d/0xd90
[  591.986838][T16231]  ? __pfx___sys_bpf+0x10/0x10
[  591.986872][T16231]  ? do_futex+0x3e7/0x4e0
[  591.986920][T16231]  ? rcu_is_watching+0x16/0xb0
[  591.986949][T16231]  __x64_sys_bpf+0xba/0xd0
[  591.986981][T16231]  do_syscall_64+0x166/0x520
[  591.987003][T16231]  ? trace_irq_disable+0x3b/0x140
[  591.987031][T16231]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  591.987054][T16231]  ? clear_bhb_loop+0x70/0xc0
[  591.987081][T16231]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  591.987103][T16231] RIP: 0033:0x7ff64159e0d9
[  591.987125][T16231] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  591.987146][T16231] RSP: 002b:00007ff6424c0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  591.987172][T16231] RAX: ffffffffffffffda RBX: 00007ff641825fa0 RCX: 00007ff64159e0d9
[  591.987190][T16231] RDX: 0000000000000094 RSI: 00002000000001c0 RDI: 0000000000000005
[  591.987206][T16231] RBP: 00007ff641635024 R08: 0000000000000000 R09: 0000000000000000
[  591.987221][T16231] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  591.987235][T16231] R13: 00007ff641826038 R14: 00007ff641825fa0 R15: 00007ff64194fa48
[  591.987269][T16231]  </TASK>
[  592.328310][T16231] Mem-Info:
[  592.331490][T16231] active_anon:7805 inactive_anon:3399 isolated_anon:0
[  592.331490][T16231]  active_file:214 inactive_file:59805 isolated_file:0
[  592.331490][T16231]  unevictable:1417 dirty:183 writeback:0
[  592.331490][T16231]  slab_reclaimable:11466 slab_unreclaimable:140260
[  592.331490][T16231]  mapped:32094 shmem:6633 pagetables:1426
[  592.331490][T16231]  sec_pagetables:0 bounce:0
[  592.331490][T16231]  kernel_misc_reclaimable:0
[  592.331490][T16231]  free:1254120 free_pcp:9500 free_cma:0
[  592.385336][T16231] Node 0 active_anon:31320kB inactive_anon:13596kB active_file:856kB inactive_file:238916kB unevictable:5968kB isolated(anon):0kB isolated(file):0kB mapped:128680kB dirty:700kB writeback:0kB shmem:26832kB shmem_thp:2048kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12744kB pagetables:5684kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  592.394957][T16238] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2863'.
[  592.447946][T16231] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:304kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:96kB dirty:32kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  592.480642][T16231] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  592.582584][T16231] lowmem_reserve[]: 0 2488 2488 2488 2488
[  592.596500][T16231] Node 0 DMA32 free:1067332kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:32020kB inactive_anon:13596kB active_file:856kB inactive_file:238916kB unevictable:8068kB writepending:700kB zspages:244kB present:3129332kB managed:2548176kB mlocked:8156kB bounce:0kB free_pcp:31144kB local_pcp:14680kB free_cma:0kB
[  592.651324][T16231] lowmem_reserve[]: 0 0 0 0 0
[  592.657678][T16231] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:260kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  592.695388][T16231] lowmem_reserve[]: 0 0 0 0 0
[  592.703546][T16231] Node 1 Normal free:3932392kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:304kB unevictable:0kB writepending:32kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:4968kB local_pcp:0kB free_cma:0kB
[  592.740342][T16231] lowmem_reserve[]: 0 0 0 0 0
[  592.746054][T16231] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB
[  592.768214][T16231] Node 0 DMA32: 1497*4kB (UME) 1176*8kB (UME) 644*16kB (UM) 607*32kB (UM) 333*64kB (UME) 166*128kB (UME) 64*256kB (ME) 33*512kB (UM) 19*1024kB (UM) 4*2048kB (UM) 224*4096kB (UM) = 1066116kB
[  592.787918][T16231] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[  592.799991][T16231] Node 1 Normal: 10*4kB (UM) 6*8kB (UM) 17*16kB (UM) 16*32kB (UM) 10*64kB (UM) 4*128kB (UM) 7*256kB (UM) 7*512kB (UM) 3*1024kB (U) 1*2048kB (M) 957*4096kB (UM) = 3932392kB
[  592.817954][T16231] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  592.828536][T16231] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB
[  592.838173][T16231] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  592.848522][T16231] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB
[  592.862437][T16232] ALSA: mixer_oss: invalid OSS volume 'u'
[  592.877160][T16231] 67701 total pagecache pages
[  592.887574][T16231] 5 pages in swap cache
[  592.897802][T16231] Free swap  = 124916kB
[  592.916966][ T5683] usb 3-1: new full-speed USB device number 18 using dummy_hcd
[  592.938971][T16231] Total swap = 124996kB
[  592.946686][T16231] 2097051 pages RAM
[  592.954079][T16231] 0 pages HighMem/MovableOnly
[  592.962290][T16231] 428327 pages reserved
[  592.968380][T16231] 0 pages cma reserved
[  593.086081][ T5683] usb 3-1: unable to get BOS descriptor or descriptor too short
[  593.110157][ T5683] usb 3-1: not running at top speed; connect to a high speed hub
[  593.124936][ T5683] usb 3-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87
[  593.160193][ T5683] usb 3-1: config 127 has an invalid interface number: 124 but max is 0
[  593.180593][ T5683] usb 3-1: config 127 has no interface number 0
[  593.204603][ T5683] usb 3-1: config 127 interface 124 has no altsetting 0
[  593.232293][ T5683] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  593.266323][ T5683] usb 3-1: Product: syz
[  593.281127][ T5683] usb 3-1: Manufacturer: syz
[  593.301343][ T5683] usb 3-1: SerialNumber: syz
[  593.551954][T16259] FAULT_INJECTION: forcing a failure.
[  593.551954][T16259] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  593.569979][T16259] CPU: 1 UID: 0 PID: 16259 Comm: syz.4.2870 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  593.570013][T16259] Tainted: [L]=SOFTLOCKUP
[  593.570021][T16259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  593.570033][T16259] Call Trace:
[  593.570042][T16259]  <TASK>
[  593.570050][T16259]  dump_stack_lvl+0xe8/0x150
[  593.570085][T16259]  should_fail_ex+0x410/0x560
[  593.570113][T16259]  _copy_to_user+0x31/0xb0
[  593.570140][T16259]  simple_read_from_buffer+0xe1/0x170
[  593.570179][T16259]  proc_fail_nth_read+0x1bb/0x230
[  593.570215][T16259]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  593.570241][T16259]  ? rw_verify_area+0x24a/0x4c0
[  593.570262][T16259]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  593.570284][T16259]  vfs_read+0x213/0xa80
[  593.570309][T16259]  ? __pfx___mutex_lock+0x10/0x10
[  593.570331][T16259]  ? __pfx_vfs_read+0x10/0x10
[  593.570353][T16259]  ? __fget_files+0x2a/0x420
[  593.570375][T16259]  ? __fget_files+0x3a2/0x420
[  593.570392][T16259]  ? __fget_files+0x2a/0x420
[  593.570418][T16259]  ksys_read+0x150/0x270
[  593.570436][T16259]  ? __pfx_filldir64+0x10/0x10
[  593.570464][T16259]  ? __pfx_ksys_read+0x10/0x10
[  593.570494][T16259]  do_syscall_64+0x166/0x520
[  593.570512][T16259]  ? trace_irq_disable+0x3b/0x140
[  593.570545][T16259]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  593.570565][T16259]  ? clear_bhb_loop+0x70/0xc0
[  593.570589][T16259]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  593.570608][T16259] RIP: 0033:0x7f7866b5e90e
[  593.570626][T16259] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  593.570643][T16259] RSP: 002b:00007f7867aeefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  593.570663][T16259] RAX: ffffffffffffffda RBX: 00007f7867aef6c0 RCX: 00007f7866b5e90e
[  593.570677][T16259] RDX: 000000000000000f RSI: 00007f7867aef0a0 RDI: 0000000000000006
[  593.570689][T16259] RBP: 00007f7867aef090 R08: 0000000000000000 R09: 0000000000000000
[  593.570701][T16259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  593.570713][T16259] R13: 00007f7866e26038 R14: 00007f7866e25fa0 R15: 00007f7866f4fa48
[  593.570743][T16259]  </TASK>
[  593.906461][T14983] Bluetooth: hci4: unexpected event 0x03 length: 1 < 11
[  594.117147][T13882] usb 1-1: new high-speed USB device number 32 using dummy_hcd
[  594.287983][T13882] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  594.344234][T13882] usb 1-1: config 1 has an invalid descriptor of length 32, skipping remainder of the config
[  594.401812][T13882] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
[  594.413707][ T5683] usb 3-1: USB disconnect, device number 18
[  594.450862][T13882] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67
[  594.465847][T13882] usb 1-1: SerialNumber: syz
[  594.549870][T16276] Invalid logical block size (14)
[  594.628286][ T5683] usb 3-1: new high-speed USB device number 19 using dummy_hcd
[  594.745504][T13882] usb 1-1: 0:2 : does not exist
[  594.757166][T13882] usb 1-1: unit 5: unexpected type 0x0e
[  594.781865][T16284] tunl0: Caught tx_queue_len zero misconfig
[  594.788615][ T5683] usb 3-1: Using ep0 maxpacket: 16
[  594.809147][ T5683] usb 3-1: unable to get BOS descriptor or descriptor too short
[  594.820773][ T5683] usb 3-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87
[  594.837039][T16284] netlink: 'syz.3.2876': attribute type 1 has an invalid length.
[  594.856657][ T5683] usb 3-1: unable to read config index 0 descriptor/start: -71
[  594.876811][ T5683] usb 3-1: can't read configurations, error -71
[  594.956413][T13882] usb 1-1: USB disconnect, device number 32
[  595.035217][ T6313] udevd[6313]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  595.086999][ T1552] usb 4-1: new high-speed USB device number 27 using dummy_hcd
[  595.257501][ T1552] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b
[  595.275486][ T1552] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  595.297890][ T1552] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  595.325984][ T1552] usb 4-1: config 0 descriptor??
[  595.737092][ T5682] usb 5-1: new low-speed USB device number 3 using dummy_hcd
[  595.749922][ T1552] ath6kl: Failed to read usb control message: -71
[  595.756636][ T1552] ath6kl: Unable to read the bmi data from the device: -71
[  595.764481][ T1552] ath6kl: Unable to recv target info: -71
[  595.771782][ T1552] ath6kl: Failed to init ath6kl core: -71
[  595.788879][ T1552] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -71
[  595.804219][ T1552] usb 4-1: USB disconnect, device number 27
[  595.887670][ T5682] usb 5-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40
[  595.897638][T13855] usb 1-1: new high-speed USB device number 33 using dummy_hcd
[  595.909290][ T5682] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1024, setting to 8
[  595.920160][ T5682] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xA has invalid maxpacket 16, setting to 0
[  595.931137][ T5682] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 16, setting to 0
[  595.941884][ T5682] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1023, setting to 8
[  595.952913][ T5682] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x8 has invalid maxpacket 512, setting to 8
[  595.963628][ T5683] usb 3-1: new high-speed USB device number 20 using dummy_hcd
[  595.967568][T13882] usb 2-1: new high-speed USB device number 34 using dummy_hcd
[  595.971723][ T5682] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0xF is Bulk; changing to Interrupt
[  595.989740][ T5682] usb 5-1: config 1 interface 0 altsetting 0 has a duplicate endpoint with address 0xF, skipping
[  596.057987][T13855] usb 1-1: Using ep0 maxpacket: 16
[  596.063953][T13855] usb 1-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice=22.00
[  596.073175][T13855] usb 1-1: too many configurations: 99, using maximum allowed: 8
[  596.083317][T13855] usb 1-1: unable to read config index 0 descriptor/start: -61
[  596.091531][T13855] usb 1-1: can't read configurations, error -61
[  596.127048][T13882] usb 2-1: Using ep0 maxpacket: 8
[  596.132861][T13882] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  596.143896][T13882] usb 2-1: config index 0 descriptor too short (expected 301, got 45)
[  596.153436][T13882] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  596.157183][ T5683] usb 3-1: Using ep0 maxpacket: 32
[  596.165496][T13882] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  596.173062][ T5683] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40
[  596.188077][T13882] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  596.192311][ T5683] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  596.198285][T13882] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  596.220808][T13882] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  596.227945][ T5683] usb 3-1: config 0 descriptor??
[  596.247007][T13855] usb 1-1: new high-speed USB device number 34 using dummy_hcd
[  596.358290][T14983] Bluetooth: hci0: unexpected event 0x03 length: 1 < 11
[  596.409514][T13855] usb 1-1: Using ep0 maxpacket: 16
[  596.422548][T13855] usb 1-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice=22.00
[  596.432074][T13855] usb 1-1: too many configurations: 99, using maximum allowed: 8
[  596.440926][ T5683] dvb-usb: found a 'Elgato EyeTV Sat' in warm state.
[  596.442857][T13855] usb 1-1: unable to read config index 0 descriptor/start: -61
[  596.455660][T13855] usb 1-1: can't read configurations, error -61
[  596.462797][T13855] usb usb1-port1: attempt power cycle
[  596.488223][T13882] usb 2-1: usb_control_msg returned -32
[  596.500630][T13882] usbtmc 2-1:16.0: can't read capabilities
[  596.503170][ T5683] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  596.538783][ T5683] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat)
[  596.566744][ T5683] usb 3-1: media controller created
[  596.604308][ T5683] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  596.641924][ T5683] az6027: usb out operation failed. (-71)
[  596.649633][ T5683] az6027: usb out operation failed. (-71)
[  596.655436][ T5683] stb0899_attach: Driver disabled by Kconfig
[  596.661747][ T5683] az6027: no front-end attached
[  596.661747][ T5683] 
[  596.669778][ T5683] az6027: usb out operation failed. (-71)
[  596.685769][ T5683] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat'
[  596.696072][ T5683] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input72
[  596.728007][ T1552] usb 2-1: USB disconnect, device number 34
[  596.735534][ T5683] dvb-usb: schedule remote query interval to 400 msecs.
[  596.761671][ T5683] dvb-usb: Elgato EyeTV Sat successfully initialized and connected.
[  596.801473][ T5683] usb 3-1: USB disconnect, device number 20
[  596.808665][T13855] usb 1-1: new high-speed USB device number 35 using dummy_hcd
[  596.838360][T13855] usb 1-1: Using ep0 maxpacket: 16
[  596.849608][T13855] usb 1-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice=22.00
[  596.866972][T13882] usb 4-1: new high-speed USB device number 28 using dummy_hcd
[  596.889166][T13855] usb 1-1: too many configurations: 99, using maximum allowed: 8
[  596.901096][T16311] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2885'.
[  596.906346][T13855] usb 1-1: unable to read config index 0 descriptor/start: -61
[  596.915310][ T5683] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected.
[  596.927738][T13855] usb 1-1: can't read configurations, error -61
[  596.933108][T16310] syzkaller0: entered promiscuous mode
[  596.943251][T16310] syzkaller0: entered allmulticast mode
[  597.047498][T13882] usb 4-1: Using ep0 maxpacket: 32
[  597.053411][T13882] usb 4-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00
[  597.062899][T13855] usb 1-1: new high-speed USB device number 36 using dummy_hcd
[  597.072954][T13882] usb 4-1: config index 0 descriptor too short (expected 164, got 36)
[  597.081495][T13882] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  597.092867][T13882] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  597.103210][T13855] usb 1-1: Using ep0 maxpacket: 16
[  597.109097][T13855] usb 1-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice=22.00
[  597.119780][T13855] usb 1-1: too many configurations: 99, using maximum allowed: 8
[  597.129380][T13882] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  597.139291][T13855] usb 1-1: unable to read config index 0 descriptor/start: -61
[  597.147910][T13855] usb 1-1: can't read configurations, error -61
[  597.156276][T13882] usb 4-1: config 0 descriptor??
[  597.163996][T13855] usb usb1-port1: unable to enumerate USB device
[  597.465354][T13882] usbhid 4-1:0.0: can't add hid device: -71
[  597.478777][T13882] usbhid 4-1:0.0: probe with driver usbhid failed with error -71
[  597.489959][T13882] usb 4-1: USB disconnect, device number 28
[  597.873724][T16328] netlink: 'syz.1.2889': attribute type 4 has an invalid length.
[  597.882003][T16328] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2889'.
[  598.534514][ T5682] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  598.573201][ T5682] usb 5-1: can't set config #1, error -71
[  598.610372][ T5682] usb 5-1: USB disconnect, device number 3
[  598.791038][T16338] socket: no more sockets
[  598.858368][T14983] Bluetooth: hci4: unexpected event 0x03 length: 1 < 11
[  600.331826][T16325] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2889'.
[  600.349380][T16328] .`: renamed from bond0 (while UP)
[  600.522784][T16355] syz_tun: entered allmulticast mode
[  600.911050][T16374] bridge_slave_0: Caught tx_queue_len zero misconfig
[  601.118237][T16353] syz_tun: left allmulticast mode
[  601.137047][ T5683] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[  601.180566][   T24] usb 4-1: new high-speed USB device number 29 using dummy_hcd
[  601.317138][ T5683] usb 5-1: Using ep0 maxpacket: 16
[  601.329015][ T5683] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00
[  601.341893][ T5683] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  601.356386][ T5683] usb 5-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0
[  601.366402][   T24] usb 4-1: Using ep0 maxpacket: 8
[  601.374080][   T24] usb 4-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c
[  601.389666][ T5683] usb 5-1: config 0 interface 0 has no altsetting 0
[  601.402883][   T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  601.413367][ T5683] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  601.421810][   T24] usb 4-1: Product: syz
[  601.429018][   T24] usb 4-1: Manufacturer: syz
[  601.435522][   T24] usb 4-1: SerialNumber: syz
[  601.441379][ T5683] usb 5-1: config 0 descriptor??
[  601.458232][   T24] usb 4-1: config 0 descriptor??
[  601.481692][   T24] gspca_main: se401-2.14.0 probing 047d:5003
[  601.581767][T16379] nvme nvme0: rdma_resolve_addr failed (-19).
[  601.636998][ T5682] usb 3-1: new high-speed USB device number 21 using dummy_hcd
[  601.737152][ T5697] usb 2-1: new high-speed USB device number 35 using dummy_hcd
[  601.808877][ T5682] usb 3-1: New USB device found, idVendor=10d6, idProduct=2200, bcdDevice= 1.00
[  601.820012][ T5682] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  601.830338][ T5682] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  601.845011][ T5682] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  601.857088][ T5682] usb 3-1: Product: syz
[  601.864804][ T5682] usb 3-1: Manufacturer: syz
[  601.875826][ T5682] usb 3-1: SerialNumber: syz
[  601.890006][   T24] gspca_se401: ExtraFeatures: 97
[  601.897688][ T5697] usb 2-1: Using ep0 maxpacket: 32
[  601.911317][ T5697] usb 2-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40
[  601.914738][   T24] gspca_se401: Too many frame sizes
[  601.943288][ T5682] usb 3-1: config 0 descriptor??
[  601.947641][ T5697] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[  601.989104][ T5697] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[  602.006236][ T5697] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  602.029337][ T5697] usb 2-1: Product: syz
[  602.035762][ T5697] usb 2-1: Manufacturer: syz
[  602.045949][ T5697] usb 2-1: SerialNumber: syz
[  602.067667][ T5697] usb 2-1: interface 1 not found
[  602.093431][ T5683] usbhid 5-1:0.0: can't add hid device: -71
[  602.103461][ T5683] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  602.113928][ T5682] usb 4-1: USB disconnect, device number 29
[  602.136659][ T5683] usb 5-1: USB disconnect, device number 4
[  602.186598][ T5697] usb 3-1: USB disconnect, device number 21
[  602.266596][T16385] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  602.281138][T16385] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  602.431058][T16399] fuse: Bad value for 'fd'
[  603.086929][ T5682] usb 5-1: new high-speed USB device number 5 using dummy_hcd
[  603.250137][ T5682] usb 5-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00
[  603.267897][ T5682] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 136
[  603.286518][ T5682] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  603.298668][ T5682] usb 5-1: Product: syz
[  603.303287][ T5682] usb 5-1: Manufacturer: syz
[  603.308080][ T5682] usb 5-1: SerialNumber: syz
[  603.321088][T16404] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  603.567002][ T5682] usblp 5-1:1.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900
[  603.799256][ T5697] usb 1-1: new high-speed USB device number 37 using dummy_hcd
[  603.964648][ T5697] usb 1-1: Using ep0 maxpacket: 32
[  603.970751][ T5697] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  603.994354][ T5697] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  604.014304][ T5697] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  604.062985][ T5697] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  604.083364][ T5697] usb 1-1: config 0 descriptor??
[  604.102828][ T5697] hub 1-1:0.0: USB hub found
[  604.167387][T16438] batadv0: entered promiscuous mode
[  604.197867][T16438] macsec1: entered promiscuous mode
[  604.214434][T16438] macsec1: entered allmulticast mode
[  604.276870][T16438] batadv0: entered allmulticast mode
[  604.285135][T16438] 8021q: adding VLAN 0 to HW filter on device macsec1
[  604.309747][ T5697] hub 1-1:0.0: 1 port detected
[  604.843546][T13882] usb 5-1: USB disconnect, device number 5
[  604.888961][ T5723] usb 2-1: USB disconnect, device number 35
[  604.903091][T13882] usblp0: removed
[  604.933360][ T5697] hub 1-1:0.0: activate --> -90
[  605.066956][ T5683] usb 4-1: new high-speed USB device number 30 using dummy_hcd
[  605.247885][ T5683] usb 4-1: New USB device found, idVendor=17cc, idProduct=1969, bcdDevice= 1.00
[  605.259011][ T5683] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  605.270870][ T5683] usb 4-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4
[  605.286121][ T5683] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  605.352952][   T30] audit: type=1326 audit(1787259543.452:3013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.377706][   T30] audit: type=1326 audit(1787259543.452:3014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.402279][   T30] audit: type=1326 audit(1787259543.452:3015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.434027][   T30] audit: type=1326 audit(1787259543.452:3016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.458933][   T30] audit: type=1326 audit(1787259543.452:3017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.483398][   T30] audit: type=1326 audit(1787259543.452:3018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.524385][   T30] audit: type=1326 audit(1787259543.452:3019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.561230][   T30] audit: type=1326 audit(1787259543.452:3020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.593401][   T30] audit: type=1326 audit(1787259543.452:3021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.625148][   T30] audit: type=1326 audit(1787259543.452:3022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16423 comm="syz.0.2918" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=447 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  605.757729][    C1] usb 4-1: received EP1 urb->status = -2
[  605.763554][ T5683] usb 4-1: unable to init card! (ret=-110)
[  605.770168][ T5683] snd-usb-caiaq 4-1:1.0: probe with driver snd-usb-caiaq failed with error -110
[  606.014669][ T5723] usb 4-1: USB disconnect, device number 30
[  606.259096][T16478] input: syz0 as /devices/virtual/input/input73
[  606.335156][T16472] netdevsim netdevsim4 netdevsim0: IPsec offload requires 128 bit authentication
[  606.415255][ T5697] hub 1-1:0.0: hub_ext_port_status failed (err = -71)
[  606.415804][ T5683] usb 1-1: USB disconnect, device number 37
[  606.656052][T16489] random: crng reseeded on system resumption
[  606.680127][T16490] loop2: detected capacity change from 0 to 7
[  606.690810][T16489] netlink: 'syz.3.2937': attribute type 4 has an invalid length.
[  606.746333][T16490]  loop2:
[  606.751410][T16490] loop2: partition table partially beyond EOD, truncated
[  606.921428][T16501] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  606.939822][T16500] kvm: pic: non byte write
[  606.948918][ T5683] usb 5-1: new high-speed USB device number 6 using dummy_hcd
[  606.970927][T16500] kvm: user requested TSC rate below hardware speed
[  606.993125][T16500] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=540686624 (1081373248 ns) > initial count (200000 ns). Using initial count to start timer.
[  607.137927][ T5683] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  607.153497][ T5683] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  607.179024][ T5683] usb 5-1: config 0 descriptor??
[  607.192396][ T5683] cp210x 5-1:0.0: cp210x converter detected
[  607.513040][T16513] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma?
[  607.526573][T16513] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma?
[  607.605583][ T5683] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32
[  607.637438][ T5683] usb 5-1: cp210x converter now attached to ttyUSB0
[  607.818194][T16517] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  608.077100][ T5697] usb 4-1: new full-speed USB device number 31 using dummy_hcd
[  608.210637][T16536] syzkaller1: entered promiscuous mode
[  608.221518][T16536] syzkaller1: entered allmulticast mode
[  608.238077][ T5697] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00
[  608.254412][T16536] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2938'.
[  608.264402][ T5697] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  608.281144][ T5682] usb 3-1: new high-speed USB device number 22 using dummy_hcd
[  608.291885][ T5697] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  608.303037][ T5697] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  608.316590][ T5697] usb 4-1: config 0 descriptor??
[  608.447535][ T5682] usb 3-1: Using ep0 maxpacket: 8
[  608.453458][ T5682] usb 3-1: New USB device found, idVendor=056e, idProduct=00fe, bcdDevice= 0.00
[  608.464197][ T5682] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  608.475558][ T5682] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  608.485804][ T5682] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 8
[  608.505061][ T5682] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  608.517152][ T5682] usb 3-1: config 0 descriptor??
[  608.557012][T13882] usb 2-1: new high-speed USB device number 36 using dummy_hcd
[  608.706924][T13882] usb 2-1: Using ep0 maxpacket: 32
[  608.713323][T13882] usb 2-1: New USB device found, idVendor=d124, idProduct=0104, bcdDevice=57.99
[  608.729643][T13882] usb 2-1: unable to read config index 0 descriptor/start: -61
[  608.730943][T16546] FAULT_INJECTION: forcing a failure.
[  608.730943][T16546] name failslab, interval 1, probability 0, space 0, times 0
[  608.737895][T13882] usb 2-1: can't read configurations, error -61
[  608.750638][T16546] CPU: 1 UID: 0 PID: 16546 Comm: syz.0.2956 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  608.750723][T16546] Tainted: [L]=SOFTLOCKUP
[  608.750742][T16546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  608.750772][T16546] Call Trace:
[  608.750807][T16546]  <TASK>
[  608.750826][T16546]  dump_stack_lvl+0xe8/0x150
[  608.750921][T16546]  should_fail_ex+0x410/0x560
[  608.750984][T16546]  should_failslab+0xa8/0x100
[  608.751036][T16546]  kmem_cache_alloc_node_noprof+0xb3/0x620
[  608.751097][T16546]  ? kmem_cache_alloc_node_noprof+0x1f7/0x620
[  608.751167][T16546]  ? __alloc_skb+0x1db/0x7a0
[  608.751227][T16546]  ? __alloc_skb+0x1db/0x7a0
[  608.751299][T16546]  __alloc_skb+0x1db/0x7a0
[  608.751385][T16546]  tipc_buf_acquire+0x2b/0xe0
[  608.751454][T16546]  tipc_msg_build+0x911/0xf50
[  608.751550][T16546]  ? __pfx_tipc_msg_build+0x10/0x10
[  608.751622][T16546]  ? net_generic+0x1e/0x240
[  608.751698][T16546]  ? net_generic+0x1e/0x240
[  608.751778][T16546]  ? tipc_group_bc_cong+0x15f/0x210
[  608.751839][T16546]  tipc_send_group_bcast+0x7db/0xad0
[  608.751947][T16546]  ? __pfx_tipc_send_group_bcast+0x10/0x10
[  608.752009][T16546]  ? is_bpf_text_address+0x26/0x2b0
[  608.752095][T16546]  ? unwind_get_return_address+0x4d/0x90
[  608.752148][T16546]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  608.752218][T16546]  ? __pfx_woken_wake_function+0x10/0x10
[  608.752278][T16546]  ? look_up_lock_class+0x57/0x110
[  608.752351][T16546]  ? register_lock_class+0x31/0x2e0
[  608.752428][T16546]  __tipc_sendmsg+0x313/0x2b60
[  608.752532][T16546]  ? __pfx___tipc_sendmsg+0x10/0x10
[  608.752600][T16546]  ? process_measurement+0x443/0x1c10
[  608.752674][T16546]  ? process_measurement+0x443/0x1c10
[  608.752742][T16546]  ? aa_label_sk_perm+0x532/0x6e0
[  608.752807][T16546]  ? __pfx_aa_label_sk_perm+0x10/0x10
[  608.752868][T16546]  ? process_measurement+0x7b2/0x1c10
[  608.752942][T16546]  ? __lock_acquire+0x683/0x2cf0
[  608.753019][T16546]  ? __lock_acquire+0x683/0x2cf0
[  608.753169][T16546]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  608.753237][T16546]  ? tipc_sendmsg+0x47/0x70
[  608.753308][T16546]  ? __local_bh_enable_ip+0xd6/0x140
[  608.753366][T16546]  tipc_sendmsg+0x55/0x70
[  608.753435][T16546]  ? __pfx_tipc_sendmsg+0x10/0x10
[  608.753497][T16546]  sock_sendmsg_nosec+0x13a/0x180
[  608.753561][T16546]  ____sys_sendmsg+0x54e/0x850
[  608.753655][T16546]  ? __pfx_____sys_sendmsg+0x10/0x10
[  608.753740][T16546]  ? import_iovec+0x73/0xa0
[  608.753796][T16546]  ___sys_sendmsg+0x2a5/0x360
[  608.753874][T16546]  ? __lock_acquire+0x683/0x2cf0
[  608.753947][T16546]  ? __pfx____sys_sendmsg+0x10/0x10
[  608.754036][T16546]  ? kstrtouint+0x6e/0xe0
[  608.754161][T16546]  ? __fget_files+0x2a/0x420
[  608.754207][T16546]  ? __fget_files+0x3a2/0x420
[  608.754273][T16546]  __sys_sendmmsg+0x273/0x4d0
[  608.754356][T16546]  ? __pfx___sys_sendmmsg+0x10/0x10
[  608.754466][T16546]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  608.754572][T16546]  ? ksys_write+0x242/0x270
[  608.754632][T16546]  ? __pfx_ksys_write+0x10/0x10
[  608.754695][T16546]  __x64_sys_sendmmsg+0xa0/0xc0
[  608.754767][T16546]  do_syscall_64+0x166/0x520
[  608.754812][T16546]  ? trace_irq_disable+0x3b/0x140
[  608.754875][T16546]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  608.754935][T16546]  ? clear_bhb_loop+0x70/0xc0
[  608.754988][T16546]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  608.755039][T16546] RIP: 0033:0x7ffac939e0d9
[  608.755083][T16546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  608.755126][T16546] RSP: 002b:00007ffaca1d0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  608.755191][T16546] RAX: ffffffffffffffda RBX: 00007ffac9626090 RCX: 00007ffac939e0d9
[  608.755216][T16546] RDX: 0400000000000181 RSI: 00002000000030c0 RDI: 0000000000000003
[  608.755252][T16546] RBP: 00007ffaca1d0090 R08: 0000000000000000 R09: 0000000000000000
[  608.755290][T16546] R10: 9200000000000000 R11: 0000000000000246 R12: 0000000000000002
[  608.755328][T16546] R13: 00007ffac9626128 R14: 00007ffac9626090 R15: 00007ffac974fa48
[  608.755408][T16546]  </TASK>
[  609.171634][ T5697] isku 0003:1E7D:319C.0026: unknown main item tag 0x0
[  609.178565][ T5697] isku 0003:1E7D:319C.0026: unknown main item tag 0x0
[  609.185412][ T5697] isku 0003:1E7D:319C.0026: unknown main item tag 0x0
[  609.192302][ T5697] isku 0003:1E7D:319C.0026: unknown main item tag 0x0
[  609.200016][ T5697] isku 0003:1E7D:319C.0026: unknown main item tag 0x0
[  609.207602][ T5697] isku 0003:1E7D:319C.0026: unknown main item tag 0x0
[  609.214683][ T5697] isku 0003:1E7D:319C.0026: unknown main item tag 0x0
[  609.225258][ T5697] isku 0003:1E7D:319C.0026: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.3-1/input0
[  609.237256][ T5697] isku 0003:1E7D:319C.0026: couldn't init struct isku_device
[  609.246567][ T5697] isku 0003:1E7D:319C.0026: couldn't install keyboard
[  609.270444][ T5697] isku 0003:1E7D:319C.0026: probe with driver isku failed with error -71
[  609.295276][ T5697] usb 4-1: USB disconnect, device number 31
[  609.344353][T16547] fido_id[16547]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory
[  609.377847][T13882] usb 2-1: new high-speed USB device number 37 using dummy_hcd
[  609.537158][T13882] usb 2-1: Using ep0 maxpacket: 32
[  609.544803][T13882] usb 2-1: New USB device found, idVendor=d124, idProduct=0104, bcdDevice=57.99
[  609.556303][T13882] usb 2-1: unable to read config index 0 descriptor/start: -61
[  609.569775][T13882] usb 2-1: can't read configurations, error -61
[  609.577438][T13882] usb usb2-port1: attempt power cycle
[  609.758680][ T5683] usb 5-1: USB disconnect, device number 6
[  609.773286][ T5683] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  609.808685][ T5683] cp210x 5-1:0.0: device disconnected
[  609.829090][T16556] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2960'.
[  609.901170][T16559] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2960'.
[  609.927922][T13882] usb 2-1: new high-speed USB device number 38 using dummy_hcd
[  609.949054][T13882] usb 2-1: Using ep0 maxpacket: 32
[  609.959347][T13882] usb 2-1: New USB device found, idVendor=d124, idProduct=0104, bcdDevice=57.99
[  609.981033][T13882] usb 2-1: unable to read config index 0 descriptor/start: -61
[  610.009907][T13882] usb 2-1: can't read configurations, error -61
[  610.149658][T13882] usb 2-1: new high-speed USB device number 39 using dummy_hcd
[  610.178540][T13882] usb 2-1: Using ep0 maxpacket: 32
[  610.184620][T13882] usb 2-1: New USB device found, idVendor=d124, idProduct=0104, bcdDevice=57.99
[  610.196006][T13882] usb 2-1: unable to read config index 0 descriptor/start: -61
[  610.204540][T13882] usb 2-1: can't read configurations, error -61
[  610.211551][T13882] usb usb2-port1: unable to enumerate USB device
[  610.400261][   T30] kauditd_printk_skb: 88 callbacks suppressed
[  610.400280][   T30] audit: type=1326 audit(1787259548.512:3111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16569 comm="syz.4.2964" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7866b9e0d9 code=0x7ffc0000
[  610.434937][   T30] audit: type=1326 audit(1787259548.512:3112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16569 comm="syz.4.2964" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7866b9e0d9 code=0x7ffc0000
[  610.719512][T16579] netlink: 'syz.3.2968': attribute type 21 has an invalid length.
[  610.760373][T16579] netlink: 'syz.3.2968': attribute type 6 has an invalid length.
[  610.790721][T16579] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2968'.
[  610.871936][ T5682] usbhid 3-1:0.0: can't add hid device: -71
[  610.884907][ T5682] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[  610.911812][ T5682] usb 3-1: USB disconnect, device number 22
[  610.948979][T16587] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  610.980924][T16588] ALSA: seq fatal error: cannot create timer (-22)
[  611.027600][T13882] usb 4-1: new high-speed USB device number 32 using dummy_hcd
[  611.239313][T16579] syzkaller0: entered promiscuous mode
[  611.246903][T16579] syzkaller0: entered allmulticast mode
[  611.350431][T13882] usb 4-1: unable to get BOS descriptor or descriptor too short
[  611.360395][T13882] usb 4-1: New USB device found, idVendor=2a39, idProduct=3fb0, bcdDevice= 0.40
[  611.386226][T13882] usb 4-1: unable to read config index 0 descriptor/start: -71
[  611.401680][T13882] usb 4-1: can't read configurations, error -71
[  611.416972][ T5682] usb 3-1: new high-speed USB device number 23 using dummy_hcd
[  611.576973][ T5682] usb 3-1: Using ep0 maxpacket: 32
[  611.584741][ T5682] usb 3-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b
[  611.609514][ T5682] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  611.624007][ T5682] usb 3-1: Product: syz
[  611.634423][ T5682] usb 3-1: Manufacturer: syz
[  611.644211][ T5682] usb 3-1: SerialNumber: syz
[  611.660929][ T5682] usb 3-1: config 0 descriptor??
[  611.759691][T16602] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2974'.
[  611.843145][T16605] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2975'.
[  611.863232][T16605] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2975'.
[  611.891100][T16605] netlink: 'syz.1.2975': attribute type 13 has an invalid length.
[  611.921652][T16605] netlink: 'syz.1.2975': attribute type 12 has an invalid length.
[  611.990205][T16610] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  612.018259][ T5723] usb 1-1: new high-speed USB device number 38 using dummy_hcd
[  612.030942][T16610] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2977'.
[  612.130889][   T30] audit: type=1326 audit(1787259550.242:3113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16613 comm="syz.3.2979" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff64159e0d9 code=0x7ffc0000
[  612.163677][   T30] audit: type=1326 audit(1787259550.242:3114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16613 comm="syz.3.2979" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff64159e0d9 code=0x7ffc0000
[  612.195653][   T30] audit: type=1326 audit(1787259550.242:3115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16613 comm="syz.3.2979" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff64159e0d9 code=0x7ffc0000
[  612.211492][ T5723] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=fd.2e
[  612.244499][   T30] audit: type=1326 audit(1787259550.242:3116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16613 comm="syz.3.2979" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff64159e0d9 code=0x7ffc0000
[  612.248442][ T5723] usb 1-1: config 171 has an invalid interface number: 109 but max is 0
[  612.294899][ T5723] usb 1-1: config 171 has an invalid descriptor of length 0, skipping remainder of the config
[  612.305066][ T5682] peak_usb 3-1:0.0 can0: unable to request usb[type=2 value=5] err=-71
[  612.307155][ T5723] usb 1-1: config 171 has no interface number 0
[  612.321030][ T5723] usb 1-1: config 171 interface 109 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1023
[  612.338521][ T5723] usb 1-1: config 171 interface 109 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7
[  612.351903][   T30] audit: type=1326 audit(1787259550.242:3117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16613 comm="syz.3.2979" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=106 compat=0 ip=0x7ff64159e0d9 code=0x7ffc0000
[  612.360885][ T5723] usb 1-1: config 171 interface 109 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 12
[  612.412392][ T5723] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  612.421285][   T30] audit: type=1326 audit(1787259550.242:3118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16613 comm="syz.3.2979" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff64159e0d9 code=0x7ffc0000
[  612.423716][ T5723] usb 1-1: Product: syz
[  612.453223][   T30] audit: type=1326 audit(1787259550.242:3119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16613 comm="syz.3.2979" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff64159e0d9 code=0x7ffc0000
[  612.480362][ T5682] peak_usb 3-1:0.0: probe with driver peak_usb failed with error -71
[  612.482611][ T5723] usb 1-1: Manufacturer: syz
[  612.498725][ T5682] usb 3-1: USB disconnect, device number 23
[  612.509833][   T30] audit: type=1326 audit(1787259550.242:3120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16613 comm="syz.3.2979" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=106 compat=0 ip=0x7ff64159e0d9 code=0x7ffc0000
[  612.529018][ T5723] usb 1-1: SerialNumber: syz
[  612.575754][T16602] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  612.765674][T16631] netlink: 'syz.1.2984': attribute type 7 has an invalid length.
[  612.885230][T16643] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2987'.
[  613.017074][ T5682] psmouse serio25: Failed to reset mouse on : -5
[  613.123596][T16649] warn_alloc: 2 callbacks suppressed
[  613.123676][T16649] syz.2.2989: vmalloc error: size 4096, failed to allocate pages, mode:0x500dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1
[  613.147297][T16649] CPU: 0 UID: 0 PID: 16649 Comm: syz.2.2989 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  613.147333][T16649] Tainted: [L]=SOFTLOCKUP
[  613.147342][T16649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  613.147356][T16649] Call Trace:
[  613.147365][T16649]  <TASK>
[  613.147375][T16649]  dump_stack_lvl+0xe8/0x150
[  613.147417][T16649]  warn_alloc+0x24c/0x270
[  613.147458][T16649]  ? __pfx_warn_alloc+0x10/0x10
[  613.147491][T16649]  ? trace_kmalloc+0x2a/0xf0
[  613.147535][T16649]  ? alloc_pages_mpol+0x24a/0x390
[  613.147569][T16649]  __vmalloc_node_range_noprof+0x1175/0x1730
[  613.147628][T16649]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  613.147661][T16649]  ? futex_unqueue+0x22/0x240
[  613.147697][T16649]  ? futex_unqueue+0x22/0x240
[  613.147746][T16649]  ? bpf_prog_alloc_no_stats+0x47/0x4f0
[  613.147774][T16649]  __vmalloc_noprof+0xd2/0x120
[  613.147802][T16649]  ? bpf_prog_alloc_no_stats+0x47/0x4f0
[  613.147834][T16649]  bpf_prog_alloc_no_stats+0x47/0x4f0
[  613.147862][T16649]  ? bpf_prog_alloc+0x2a/0x1a0
[  613.147893][T16649]  bpf_prog_alloc+0x3c/0x1a0
[  613.147925][T16649]  bpf_prog_load+0x7f8/0x1c00
[  613.147964][T16649]  ? __pfx_bpf_prog_load+0x10/0x10
[  613.148015][T16649]  __sys_bpf+0xd0d/0xd90
[  613.148051][T16649]  ? __pfx___sys_bpf+0x10/0x10
[  613.148082][T16649]  ? do_futex+0x3e7/0x4e0
[  613.148126][T16649]  ? rcu_is_watching+0x16/0xb0
[  613.148151][T16649]  __x64_sys_bpf+0xba/0xd0
[  613.148180][T16649]  do_syscall_64+0x166/0x520
[  613.148199][T16649]  ? trace_irq_disable+0x3b/0x140
[  613.148222][T16649]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  613.148242][T16649]  ? clear_bhb_loop+0x70/0xc0
[  613.148265][T16649]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  613.148285][T16649] RIP: 0033:0x7fb9c479e0d9
[  613.148303][T16649] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  613.148320][T16649] RSP: 002b:00007fb9c29f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  613.148342][T16649] RAX: ffffffffffffffda RBX: 00007fb9c4a25fa0 RCX: 00007fb9c479e0d9
[  613.148358][T16649] RDX: 0000000000000094 RSI: 00002000000001c0 RDI: 0000000000000005
[  613.148371][T16649] RBP: 00007fb9c4835024 R08: 0000000000000000 R09: 0000000000000000
[  613.148385][T16649] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  613.148397][T16649] R13: 00007fb9c4a26038 R14: 00007fb9c4a25fa0 R15: 00007fb9c4b4fa48
[  613.148428][T16649]  </TASK>
[  613.148519][T16649] Mem-Info:
[  613.409816][T16649] active_anon:7738 inactive_anon:3399 isolated_anon:0
[  613.409816][T16649]  active_file:214 inactive_file:59880 isolated_file:0
[  613.409816][T16649]  unevictable:0 dirty:73 writeback:0
[  613.409816][T16649]  slab_reclaimable:11370 slab_unreclaimable:140749
[  613.409816][T16649]  mapped:30678 shmem:5169 pagetables:1394
[  613.409816][T16649]  sec_pagetables:0 bounce:0
[  613.409816][T16649]  kernel_misc_reclaimable:0
[  613.409816][T16649]  free:1251497 free_pcp:12665 free_cma:0
[  613.457430][T16649] Node 0 active_anon:30952kB inactive_anon:13596kB active_file:856kB inactive_file:239216kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:122612kB dirty:248kB writeback:0kB shmem:20676kB shmem_thp:2048kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12860kB pagetables:5456kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  613.493399][T16649] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:304kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:100kB dirty:44kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB
[  613.534163][T16649] Node 0 DMA free:15356kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  613.565704][T13882] usb 5-1: new high-speed USB device number 7 using dummy_hcd
[  613.573703][T16649] lowmem_reserve[]: 0 2488 2488 2488 2488
[  613.580923][T16649] Node 0 DMA32 free:1056528kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:30952kB inactive_anon:13596kB active_file:856kB inactive_file:239216kB unevictable:0kB writepending:248kB zspages:244kB present:3129332kB managed:2548176kB mlocked:0kB bounce:0kB free_pcp:47200kB local_pcp:25960kB free_cma:0kB
[  613.617417][T16649] lowmem_reserve[]: 0 0 0 0 0
[  613.622320][T16649] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:260kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  613.668931][T16649] lowmem_reserve[]: 0 0 0 0 0
[  613.683040][T16649] Node 1 Normal free:3934104kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:304kB unevictable:0kB writepending:44kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:3204kB local_pcp:0kB free_cma:0kB
[  613.719277][ T5723] ath6kl: Failed to submit usb control message: -110
[  613.726123][ T5723] ath6kl: unable to send the bmi data to the device: -110
[  613.733692][ T5723] ath6kl: Unable to send get target info: -110
[  613.740047][T13882] usb 5-1: Using ep0 maxpacket: 16
[  613.748069][T13882] usb 5-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a
[  613.764411][T16649] lowmem_reserve[]: 0
[  613.764531][ T5723] ath6kl: Failed to init ath6kl core: -110
[  613.774963][T16649]  0 0 0 0
[  613.778377][T16649] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB
[  613.795855][ T5723] ath6kl_usb 1-1:171.109: probe with driver ath6kl_usb failed with error -110
[  613.808729][T16649] Node 0 DMA32: 2208*4kB (UME) 1089*8kB (UME) 214*16kB (UME) 733*32kB (UME) 342*64kB (UME) 165*128kB (UME) 65*256kB (UME) 32*512kB (UM) 18*1024kB (UM) 4*2048kB (UM) 222*4096kB (UM) = 1056392kB
[  613.832725][T16649] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[  613.845311][T13882] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  613.860277][T13882] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  613.875866][T16649] Node 1 Normal: 9*4kB (UM) 5*8kB (UM) 16*16kB (UM) 14*32kB (UM) 9*64kB (UM) 5*128kB (UM) 6*256kB (UM) 7*512kB (UM) 5*1024kB (UM) 1*2048kB (M) 957*4096kB (UM) = 3934156kB
[  613.894603][T13882] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  613.906155][T16649] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  613.916543][T16649] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB
[  613.926194][T16649] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  613.936060][T16649] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB
[  613.946113][T16649] 65264 total pagecache pages
[  613.951577][T16649] 5 pages in swap cache
[  613.956018][T13882] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  613.964254][T13882] usb 5-1: Product: syz
[  613.968544][T13882] usb 5-1: Manufacturer: syz
[  613.973190][T13882] usb 5-1: SerialNumber: syz
[  613.978053][T16649] Free swap  = 124916kB
[  613.985139][T13882] usb 5-1: config 0 descriptor??
[  613.990409][T16649] Total swap = 124996kB
[  613.995239][T16649] 2097051 pages RAM
[  613.999353][T16649] 0 pages HighMem/MovableOnly
[  614.004467][T16652] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  614.014010][T16649] 428327 pages reserved
[  614.019354][T16649] 0 pages cma reserved
[  614.027926][T13882] pegasus_notetaker 5-1:0.0: packet size is too small (0)
[  614.035135][T13882] pegasus_notetaker 5-1:0.0: probe with driver pegasus_notetaker failed with error -22
[  614.227358][T13882] usb 5-1: USB disconnect, device number 7
[  614.271810][T16663] netlink: 'syz.2.2992': attribute type 1 has an invalid length.
[  614.400762][T16662] kvm_intel: kvm [16659]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x1d9) = 0x7b0a
[  614.415213][T16662] kvm_pr_unimpl_wrmsr: 42 callbacks suppressed
[  614.415290][T16662] kvm: kvm [16659]: vcpu1, guest rIP: 0x9114 Unhandled WRMSR(0x186) = 0xec05
[  614.888766][ T5683] usb 1-1: USB disconnect, device number 38
[  615.252193][T16678] fuse: Unknown parameter ''
[  615.933655][T16694] nvme0: failed to create debugfs directory
[  615.939819][T16694] nvme nvme0: rdma_resolve_addr failed (-19).
[  616.037087][ T5683] usb 2-1: new high-speed USB device number 40 using dummy_hcd
[  616.209136][ T5683] usb 2-1: Using ep0 maxpacket: 16
[  616.214838][ T5683] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00
[  616.225047][ T5683] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  616.236079][ T5683] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  616.245873][ T5683] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  616.259007][ T5683] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  616.269741][ T5683] usb 2-1: config 0 descriptor??
[  616.634976][T16699] input: syz1 as /devices/virtual/input/input76
[  616.732773][T16700] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3004'.
[  616.887417][ T5683] usbhid 2-1:0.0: can't add hid device: -71
[  616.901011][ T5683] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[  616.920055][ T5683] usb 2-1: USB disconnect, device number 40
[  617.046939][ T5682] misc userio: Buffer overflowed, userio client isn't keeping up
[  617.921793][ T5682] input: PS/2 Generic Mouse as /devices/serio25/input/input74
[  618.167598][ T5682] psmouse serio25: Failed to enable mouse on 
[  618.274761][   T30] kauditd_printk_skb: 45 callbacks suppressed
[  618.274778][   T30] audit: type=1326 audit(1787259556.382:3166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.347740][   T30] audit: type=1326 audit(1787259556.412:3167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.400862][   T30] audit: type=1326 audit(1787259556.422:3168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.466437][   T30] audit: type=1326 audit(1787259556.422:3169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.512588][   T30] audit: type=1326 audit(1787259556.422:3170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=306 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.554669][   T30] audit: type=1326 audit(1787259556.422:3171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.584819][   T30] audit: type=1326 audit(1787259556.422:3172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.611186][   T30] audit: type=1326 audit(1787259556.422:3173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.638530][   T30] audit: type=1326 audit(1787259556.422:3174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.664402][T16743] fuse: root generation should be zero
[  618.671763][   T30] audit: type=1326 audit(1787259556.422:3175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16730 comm="syz.0.3013" exe="/root/ci-upstream-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ffac939e0d9 code=0x7ffc0000
[  618.760732][T16745] fuse: fd is not a fuse device
[  618.797264][ T5682] usb 1-1: new full-speed USB device number 39 using dummy_hcd
[  618.878747][T16749] netlink: 'syz.2.3020': attribute type 25 has an invalid length.
[  618.887366][T16749] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3020'.
[  618.937000][ T5683] usb 2-1: new high-speed USB device number 41 using dummy_hcd
[  618.948162][ T5682] usb 1-1: New USB device found, idVendor=110a, idProduct=1150, bcdDevice=55.9e
[  618.968767][ T5682] usb 1-1: config 0 has an invalid interface number: 70 but max is 0
[  618.978487][ T5682] usb 1-1: config 0 has no interface number 0
[  618.994790][T16752] random: crng reseeded on system resumption
[  618.997431][ T5682] usb 1-1: config 0 interface 70 altsetting 5 has a duplicate endpoint with address 0x6, skipping
[  619.021078][T16752] netlink: 'syz.2.3021': attribute type 4 has an invalid length.
[  619.027418][ T5682] usb 1-1: config 0 interface 70 altsetting 5 has an endpoint descriptor with address 0xE3, changing to 0x83
[  619.047503][ T5682] usb 1-1: config 0 interface 70 altsetting 5 endpoint 0x83 has invalid maxpacket 42809, setting to 64
[  619.065731][ T5682] usb 1-1: config 0 interface 70 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3
[  619.079052][ T5682] usb 1-1: config 0 interface 70 has no altsetting 0
[  619.088521][ T5682] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  619.096752][ T5682] usb 1-1: Product: syz
[  619.101353][ T5683] usb 2-1: Using ep0 maxpacket: 32
[  619.108239][ T5682] usb 1-1: Manufacturer: syz
[  619.113002][ T5682] usb 1-1: SerialNumber: syz
[  619.118388][ T5683] usb 2-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40
[  619.144034][ T5683] usb 2-1: config 0 has an invalid interface number: 12 but max is 0
[  619.152605][ T5683] usb 2-1: config 0 has no interface number 0
[  619.159611][ T5682] usb 1-1: config 0 descriptor??
[  619.168302][T16737] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  619.181516][ T5683] usb 2-1: config 0 interface 12 has no altsetting 0
[  619.202810][ T5683] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  619.216138][ T5683] usb 2-1: Product: syz
[  619.223497][ T5683] usb 2-1: Manufacturer: syz
[  619.232998][ T5683] usb 2-1: SerialNumber: syz
[  619.243050][ T5683] usb 2-1: config 0 descriptor??
[  619.287824][T16758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3022'.
[  619.298443][T16758] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3022'.
[  619.402660][ T5682] ti_usb_3410_5052 1-1:0.70: TI USB 3410 1 port adapter converter detected
[  619.427477][ T5682] usb 1-1: TI USB 3410 1 port adapter converter now attached to ttyUSB0
[  619.455346][ T5682] usb 1-1: USB disconnect, device number 39
[  619.483164][ T5682] ti_usb_3410_5052_1 ttyUSB0: TI USB 3410 1 port adapter converter now disconnected from ttyUSB0
[  619.508762][ T5682] ti_usb_3410_5052 1-1:0.70: device disconnected
[  619.517259][   T24] usb 5-1: new high-speed USB device number 8 using dummy_hcd
[  619.689171][   T24] usb 5-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00
[  619.714033][   T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  619.729537][   T24] usb 5-1: Product: syz
[  619.737614][   T24] usb 5-1: Manufacturer: syz
[  619.746917][   T24] usb 5-1: SerialNumber: syz
[  619.764027][   T24] usb 5-1: UAS is ignored for this device, using usb-storage instead
[  619.773017][   T24] usb 5-1: UAS is ignored for this device, using usb-storage instead
[  619.781481][   T24] usb-storage 5-1:1.0: USB Mass Storage device detected
[  619.792486][   T24] usb-storage 5-1:1.0: Quirks match for vid 174c pid 55aa: 400000
[  619.805435][   T24] scsi host1: usb-storage 5-1:1.0
[  620.376990][   T24] usb 1-1: new high-speed USB device number 40 using dummy_hcd
[  620.415867][T16776] netlink: 'syz.2.3029': attribute type 21 has an invalid length.
[  620.524720][ T5682] usb 5-1: USB disconnect, device number 8
[  620.547730][   T24] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[  620.582307][   T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  620.601702][   T24] usb 1-1: config 0 descriptor??
[  620.648505][T16782] socket: no more sockets
[  620.814608][T16786] random: crng reseeded on system resumption
[  620.821893][   T24] usbhid 1-1:0.0: can't add hid device: -71
[  620.837889][   T24] usbhid 1-1:0.0: probe with driver usbhid failed with error -71
[  620.850506][   T24] usb 1-1: USB disconnect, device number 40
[  620.884602][T16786] netlink: 'syz.2.3032': attribute type 4 has an invalid length.
[  620.969540][ T5682] usb 5-1: new high-speed USB device number 9 using dummy_hcd
[  621.133402][T16801] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3036'.
[  621.139969][ T5682] usb 5-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.40
[  621.153505][T16801] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3036'.
[  621.156785][ T5682] usb 5-1: config 1 interface 0 has no altsetting 0
[  621.171739][ T5682] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  621.180307][ T5682] usb 5-1: Product: syz
[  621.184580][ T5682] usb 5-1: Manufacturer: syz
[  621.191364][ T5682] usb 5-1: SerialNumber: syz
[  621.247192][ T1552] usb 3-1: new high-speed USB device number 24 using dummy_hcd
[  621.276986][   T24] usb 1-1: new high-speed USB device number 41 using dummy_hcd
[  621.385416][T16808] rdma_op ffff88801e7dc9f0 conn xmit_rdma 0000000000000000
[  621.401170][ T1552] usb 3-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00
[  621.415875][ T1552] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  621.424295][ T1552] usb 3-1: Product: syz
[  621.428770][ T1552] usb 3-1: Manufacturer: syz
[  621.433720][ T1552] usb 3-1: SerialNumber: syz
[  621.439001][   T24] usb 1-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40
[  621.456729][   T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  621.477488][ T5682] usbhid 5-1:1.0: can't add hid device: -71
[  621.500383][ T1552] uvcvideo 3-1:1.0: Found UVC 1.00 device syz (046d:0821)
[  621.508556][ T5682] usbhid 5-1:1.0: probe with driver usbhid failed with error -71
[  621.523596][   T24] usb 1-1: config 0 descriptor??
[  621.536110][ T5683] f81534 2-1:0.12: f81534_get_register: reg: 1003 failed: -32
[  621.546167][ T5682] usb 5-1: USB disconnect, device number 9
[  621.559997][T16810] FAULT_INJECTION: forcing a failure.
[  621.559997][T16810] name failslab, interval 1, probability 0, space 0, times 0
[  621.572974][T16810] CPU: 0 UID: 0 PID: 16810 Comm: syz.3.3039 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  621.573006][T16810] Tainted: [L]=SOFTLOCKUP
[  621.573014][T16810] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  621.573026][T16810] Call Trace:
[  621.573035][T16810]  <TASK>
[  621.573043][T16810]  dump_stack_lvl+0xe8/0x150
[  621.573079][T16810]  should_fail_ex+0x410/0x560
[  621.573105][T16810]  ? __se_sys_add_key+0x289/0x420
[  621.573197][T16810]  should_failslab+0xa8/0x100
[  621.573220][T16810]  __kvmalloc_node_noprof+0x176/0x870
[  621.573295][T16810]  ? __se_sys_add_key+0x289/0x420
[  621.573323][T16810]  ? memdup_user+0x99/0xd0
[  621.573370][T16810]  __se_sys_add_key+0x289/0x420
[  621.573407][T16810]  ? __pfx___se_sys_add_key+0x10/0x10
[  621.573443][T16810]  ? __x64_sys_add_key+0x20/0xc0
[  621.573472][T16810]  do_syscall_64+0x166/0x520
[  621.573494][T16810]  ? trace_irq_disable+0x3b/0x140
[  621.573521][T16810]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  621.573543][T16810]  ? clear_bhb_loop+0x70/0xc0
[  621.573567][T16810]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  621.573586][T16810] RIP: 0033:0x7ff64159e0d9
[  621.573605][T16810] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  621.573623][T16810] RSP: 002b:00007ff6424c0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8
[  621.573642][T16810] RAX: ffffffffffffffda RBX: 00007ff641825fa0 RCX: 00007ff64159e0d9
[  621.573656][T16810] RDX: 0000200000000100 RSI: 0000200000000180 RDI: 0000200000000140
[  621.573670][T16810] RBP: 00007ff6424c0090 R08: fffffffffffffffe R09: 0000000000000000
[  621.573683][T16810] R10: 00000000000000ca R11: 0000000000000246 R12: 0000000000000001
[  621.573694][T16810] R13: 00007ff641826038 R14: 00007ff641825fa0 R15: 00007ff64194fa48
[  621.573724][T16810]  </TASK>
[  621.574072][ T5683] f81534 2-1:0.12: f81534_find_config_idx: read failed: -32
[  621.779653][T16774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  621.781693][ T5683] f81534 2-1:0.12: f81534_calc_num_ports: find idx failed: -32
[  621.795813][ T5683] f81534 2-1:0.12: probe with driver f81534 failed with error -32
[  621.880554][T16774] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  621.890490][T13880] usb 2-1: USB disconnect, device number 41
[  622.210506][T16820] nvme nvme0: rdma_resolve_addr failed (-19).
[  622.306998][ T5682] usb 4-1: new full-speed USB device number 34 using dummy_hcd
[  622.401634][T16834] FAULT_INJECTION: forcing a failure.
[  622.401634][T16834] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  622.416442][T16834] CPU: 1 UID: 0 PID: 16834 Comm: syz.4.3044 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  622.416477][T16834] Tainted: [L]=SOFTLOCKUP
[  622.416489][T16834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  622.416500][T16834] Call Trace:
[  622.416507][T16834]  <TASK>
[  622.416516][T16834]  dump_stack_lvl+0xe8/0x150
[  622.416569][T16834]  should_fail_ex+0x410/0x560
[  622.416598][T16834]  strncpy_from_user+0x36/0x2c0
[  622.416627][T16834]  do_getname+0x77/0x250
[  622.416664][T16834]  __se_sys_mknodat+0x27/0x150
[  622.416695][T16834]  do_syscall_64+0x166/0x520
[  622.416716][T16834]  ? trace_irq_disable+0x3b/0x140
[  622.416746][T16834]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  622.416770][T16834]  ? clear_bhb_loop+0x70/0xc0
[  622.416806][T16834]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  622.416829][T16834] RIP: 0033:0x7f7866b9e0d9
[  622.416850][T16834] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  622.416869][T16834] RSP: 002b:00007f7867ace028 EFLAGS: 00000246 ORIG_RAX: 0000000000000103
[  622.416892][T16834] RAX: ffffffffffffffda RBX: 00007f7866e26090 RCX: 00007f7866b9e0d9
[  622.416908][T16834] RDX: 0000000000001000 RSI: 0000200000000000 RDI: ffffffffffffff9c
[  622.416923][T16834] RBP: 00007f7867ace090 R08: 0000000000000000 R09: 0000000000000000
[  622.416937][T16834] R10: 0000000000000103 R11: 0000000000000246 R12: 0000000000000001
[  622.416949][T16834] R13: 00007f7866e26128 R14: 00007f7866e26090 R15: 00007f7866f4fa48
[  622.416980][T16834]  </TASK>
[  622.580448][   T24] aiptek 1-1:0.0: Aiptek using 400 ms programming speed
[  622.614648][ T5682] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36
[  622.645171][   T24] input: Aiptek as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input77
[  622.658560][ T5682] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86
[  622.670616][ T5682] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 10
[  622.682318][ T5682] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0
[  622.692895][ T5682] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 65535, setting to 64
[  622.712211][ T5682] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  622.720476][ T5682] usb 4-1: Product: syz
[  622.726289][ T5682] usb 4-1: Manufacturer: syz
[  622.731813][ T5682] usb 4-1: SerialNumber: syz
[  622.745460][ T5682] usb 4-1: config 0 descriptor??
[  622.770755][T16838] fuse: Unknown parameter ''
[  622.841942][ T1552] uvcvideo 3-1:1.0: Failed to query (GET_INFO) UVC control 1 on unit 3: -71 (exp. 1).
[  622.857143][ T1552] uvcvideo 3-1:1.0: No streaming interface found for terminal 32770.
[  622.883621][ T1552] usb 3-1: USB disconnect, device number 24
[  622.986983][T13880] usb 5-1: new high-speed USB device number 10 using dummy_hcd
[  623.051383][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.060857][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.077300][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.088545][T13882] usb 2-1: new high-speed USB device number 42 using dummy_hcd
[  623.098774][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.105409][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.112752][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.121593][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.128324][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.137577][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.141793][ T5723] usb 1-1: USB disconnect, device number 41
[  623.143763][    C1] aiptek 1-1:0.0: aiptek_irq - usb_submit_urb failed with result -19
[  623.167882][T13880] usb 5-1: Using ep0 maxpacket: 32
[  623.171464][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.179568][T13880] usb 5-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66
[  623.195121][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.210580][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.214930][T13880] usb 5-1: config index 0 descriptor too short (expected 156, got 27)
[  623.220414][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.237156][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.237593][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.238009][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.239875][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.258774][T13880] usb 5-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30
[  623.280316][T13880] usb 5-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7
[  623.293764][T13880] usb 5-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144
[  623.310970][T13882] usb 2-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b
[  623.324415][T13880] usb 5-1: config 0 interface 0 has no altsetting 0
[  623.332151][T13882] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0
[  623.348016][T13882] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0
[  623.348345][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.360658][T13882] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0
[  623.391906][T13880] usb 5-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172
[  623.396063][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.409197][T13880] usb 5-1: Product: syz
[  623.409949][ T5682] iforce 4-1:0.0: usb_submit_urb failed: -71
[  623.428764][ T5682] input input78: Timeout waiting for response from device.
[  623.441856][T13882] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0
[  623.453639][T13880] usb 5-1: Manufacturer: syz
[  623.464498][T13880] usb 5-1: SerialNumber: syz
[  623.477029][T13882] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  623.493782][T13880] usb 5-1: config 0 descriptor??
[  623.496020][ T5682] usb 4-1: USB disconnect, device number 34
[  623.546136][T13882] usb 2-1: config 0 descriptor??
[  623.552003][T13880] ldusb 5-1:0.0: Interrupt out endpoint not found (using control endpoint instead)
[  623.598219][T13880] ldusb 5-1:0.0: LD USB Device #0 now attached to major 180 minor 0
[  623.918574][T13882] hdpvr 2-1:0.0: unexpected answer of status request, len -71
[  623.949975][ T5723] usb 5-1: USB disconnect, device number 10
[  623.950645][    C0] ldusb 5-1:0.0: usb_submit_urb failed (-19)
[  623.964694][T13882] hdpvr 2-1:0.0: device init failed
[  623.972770][T16836] ldusb 5-1:0.0: Couldn't submit HID_REQ_SET_REPORT -71
[  624.000910][T13882] hdpvr 2-1:0.0: probe with driver hdpvr failed with error -12
[  624.011598][ T5723] ldusb 5-1:0.0: LD USB Device #0 now disconnected
[  624.028966][T16855] ldusb: No device or device unplugged -19
[  624.046643][T13882] usb 2-1: USB disconnect, device number 42
[  624.075984][T16860] netlink: 'syz.2.3051': attribute type 8 has an invalid length.
[  624.251527][ T1303] ieee802154 phy0 wpan0: encryption failed: -22
[  624.261240][ T1303] ieee802154 phy1 wpan1: encryption failed: -22
[  624.831074][T16874] FAULT_INJECTION: forcing a failure.
[  624.831074][T16874] name failslab, interval 1, probability 0, space 0, times 0
[  624.844088][T16874] CPU: 1 UID: 0 PID: 16874 Comm: syz.4.3056 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  624.844118][T16874] Tainted: [L]=SOFTLOCKUP
[  624.844125][T16874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  624.844137][T16874] Call Trace:
[  624.844144][T16874]  <TASK>
[  624.844152][T16874]  dump_stack_lvl+0xe8/0x150
[  624.844184][T16874]  should_fail_ex+0x410/0x560
[  624.844209][T16874]  should_failslab+0xa8/0x100
[  624.844230][T16874]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  624.844256][T16874]  ? vm_area_dup+0x28/0x670
[  624.844280][T16874]  ? vm_area_dup+0x28/0x670
[  624.844305][T16874]  ? is_bpf_text_address+0x26/0x2b0
[  624.844336][T16874]  vm_area_dup+0x28/0x670
[  624.844361][T16874]  ? __split_vma+0x1c6/0xa50
[  624.844384][T16874]  __split_vma+0x1dc/0xa50
[  624.844405][T16874]  ? __lock_acquire+0x683/0x2cf0
[  624.844436][T16874]  ? is_bpf_text_address+0x26/0x2b0
[  624.844484][T16874]  ? __pfx___split_vma+0x10/0x10
[  624.844515][T16874]  ? look_up_lock_class+0x57/0x110
[  624.844548][T16874]  ? register_lock_class+0x31/0x2e0
[  624.844590][T16874]  vms_gather_munmap_vmas+0x322/0x1370
[  624.844621][T16874]  ? mtree_range_walk+0x707/0x8b0
[  624.844753][T16874]  ? __pfx_vms_gather_munmap_vmas+0x10/0x10
[  624.844783][T16874]  ? mas_find+0xa23/0xcf0
[  624.844809][T16874]  mmap_region+0x8f9/0x2310
[  624.844842][T16874]  ? up_write+0x19d/0x4a0
[  624.844868][T16874]  ? __pfx_mmap_region+0x10/0x10
[  624.844887][T16874]  ? __lock_acquire+0x683/0x2cf0
[  624.844921][T16874]  ? __lock_acquire+0x683/0x2cf0
[  624.844954][T16874]  ? __pfx_process_measurement+0x10/0x10
[  624.845001][T16874]  ? __lock_acquire+0x683/0x2cf0
[  624.845069][T16874]  ? __lock_acquire+0x683/0x2cf0
[  624.845119][T16874]  ? __pfx_arch_get_unmapped_area_topdown+0x10/0x10
[  624.845181][T16874]  ? cap_mmap_addr+0xaf/0x100
[  624.845237][T16874]  ? bpf_lsm_mmap_addr+0x9/0x50
[  624.845264][T16874]  ? security_mmap_addr+0x71/0x240
[  624.845321][T16874]  ? shmem_mapping+0xd/0x50
[  624.845350][T16874]  ? memfd_check_seals_mmap+0xc5/0x200
[  624.845381][T16874]  do_mmap+0xc3b/0x10c0
[  624.845415][T16874]  ? __pfx_do_mmap+0x10/0x10
[  624.845436][T16874]  ? down_write_killable+0x17e/0x240
[  624.845491][T16874]  ? __pfx_down_write_killable+0x10/0x10
[  624.845515][T16874]  ? apparmor_mmap_file+0x2da/0x3e0
[  624.845607][T16874]  vm_mmap_pgoff+0x272/0x4e0
[  624.845636][T16874]  ? __pfx_vm_mmap_pgoff+0x10/0x10
[  624.845658][T16874]  ? __fget_files+0x2a/0x420
[  624.845683][T16874]  ? __fget_files+0x3a2/0x420
[  624.845702][T16874]  ? __fget_files+0x2a/0x420
[  624.845724][T16874]  ksys_mmap_pgoff+0x4dc/0x760
[  624.845773][T16874]  do_syscall_64+0x166/0x520
[  624.845806][T16874]  ? trace_irq_disable+0x3b/0x140
[  624.845833][T16874]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  624.845853][T16874]  ? clear_bhb_loop+0x70/0xc0
[  624.845876][T16874]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  624.845897][T16874] RIP: 0033:0x7f7866b9e0d9
[  624.845916][T16874] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  624.845931][T16874] RSP: 002b:00007f7867aef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[  624.845952][T16874] RAX: ffffffffffffffda RBX: 00007f7866e25fa0 RCX: 00007f7866b9e0d9
[  624.845965][T16874] RDX: 0000000000000003 RSI: 0000000000003000 RDI: 0000200000ffc000
[  624.845979][T16874] RBP: 00007f7867aef090 R08: 0000000000000003 R09: 0000000000000000
[  624.845991][T16874] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001
[  624.846002][T16874] R13: 00007f7866e26038 R14: 00007f7866e25fa0 R15: 00007f7866f4fa48
[  624.846033][T16874]  </TASK>
[  625.280844][ T1552] usb 2-1: new high-speed USB device number 43 using dummy_hcd
[  625.449913][ T1552] usb 2-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00
[  625.460191][ T1552] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  625.470464][ T1552] usb 2-1: config 1 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 4
[  625.485413][ T1552] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  625.494770][ T1552] usb 2-1: Product: syz
[  625.499028][ T1552] usb 2-1: Manufacturer: syz
[  625.503647][ T1552] usb 2-1: SerialNumber: syz
[  625.523792][ T1552] usb-storage 2-1:1.0: USB Mass Storage device detected
[  625.542447][ T1552] usb-storage 2-1:1.0: Quirks match for vid 174c pid 55aa: 400000
[  625.550894][ T1552] scsi host1: usb-storage 2-1:1.0
[  625.576996][ T5682] usb 1-1: new high-speed USB device number 42 using dummy_hcd
[  625.591196][T16880] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3059'.
[  625.619296][T16880] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3059'.
[  625.723828][T16870] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  625.737841][ T5682] usb 1-1: New USB device found, idVendor=046d, idProduct=c29b, bcdDevice= 0.00
[  625.741866][T16870] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  625.758607][ T5682] usb 1-1: config 0 interface 0 altsetting 37 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  625.787809][T13882] usb 2-1: USB disconnect, device number 43
[  625.804534][ T5682] usb 1-1: config 0 interface 0 altsetting 37 endpoint 0x81 has invalid wMaxPacketSize 0
[  625.854920][ T5682] usb 1-1: config 0 interface 0 altsetting 37 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  625.879287][ T5682] usb 1-1: config 0 interface 0 has no altsetting 0
[  625.897752][ T5682] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  625.922735][ T5682] usb 1-1: config 0 descriptor??
[  626.118790][T16906] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3064'.
[  626.296610][T16920] Invalid argument reading file caps for ./file0
[  626.379032][ T5682] input: HID 046d:c29b as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:046D:C29B.0027/input/input79
[  626.406971][T13882] usb 4-1: new high-speed USB device number 35 using dummy_hcd
[  626.460431][T16924] FAULT_INJECTION: forcing a failure.
[  626.460431][T16924] name failslab, interval 1, probability 0, space 0, times 0
[  626.497245][T16924] CPU: 0 UID: 0 PID: 16924 Comm: syz.1.3068 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  626.497281][T16924] Tainted: [L]=SOFTLOCKUP
[  626.497290][T16924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  626.497304][T16924] Call Trace:
[  626.497313][T16924]  <TASK>
[  626.497322][T16924]  dump_stack_lvl+0xe8/0x150
[  626.497360][T16924]  should_fail_ex+0x410/0x560
[  626.497391][T16924]  should_failslab+0xa8/0x100
[  626.497417][T16924]  __kmalloc_noprof+0xfe/0x720
[  626.497448][T16924]  ? rcu_is_watching+0x16/0xb0
[  626.497481][T16924]  ? tomoyo_realpath_from_path+0xef/0x640
[  626.497611][T16924]  ? tomoyo_realpath_from_path+0xef/0x640
[  626.497648][T16924]  tomoyo_realpath_from_path+0xef/0x640
[  626.497688][T16924]  ? tomoyo_path_number_perm+0x219/0x5f0
[  626.497712][T16924]  tomoyo_path_number_perm+0x246/0x5f0
[  626.497736][T16924]  ? __lock_acquire+0x683/0x2cf0
[  626.497780][T16924]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  626.497801][T16924]  ? __memcg_slab_post_alloc_hook+0x4a8/0xf10
[  626.497873][T16924]  ? __pfx_current_check_access_path+0x10/0x10
[  626.497901][T16924]  ? d_splice_alias+0x12/0x30
[  626.497934][T16924]  tomoyo_path_mknod+0x14a/0x1a0
[  626.497967][T16924]  ? __pfx_tomoyo_path_mknod+0x10/0x10
[  626.498001][T16924]  ? __pfx_filename_create+0x10/0x10
[  626.498033][T16924]  security_path_mknod+0x176/0x370
[  626.498065][T16924]  filename_mknodat+0x2be/0x660
[  626.498098][T16924]  ? __pfx_filename_mknodat+0x10/0x10
[  626.498128][T16924]  ? do_getname+0x151/0x250
[  626.498163][T16924]  __se_sys_mknodat+0x3b/0x150
[  626.498193][T16924]  do_syscall_64+0x166/0x520
[  626.498214][T16924]  ? trace_irq_disable+0x3b/0x140
[  626.498242][T16924]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  626.498265][T16924]  ? clear_bhb_loop+0x70/0xc0
[  626.498293][T16924]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  626.498315][T16924] RIP: 0033:0x7f6bd3d9e0d9
[  626.498336][T16924] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  626.498356][T16924] RSP: 002b:00007f6bd4c24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000103
[  626.498389][T16924] RAX: ffffffffffffffda RBX: 00007f6bd4026090 RCX: 00007f6bd3d9e0d9
[  626.498410][T16924] RDX: 0000000000001000 RSI: 0000200000000000 RDI: ffffffffffffff9c
[  626.498425][T16924] RBP: 00007f6bd4c24090 R08: 0000000000000000 R09: 0000000000000000
[  626.498438][T16924] R10: 0000000000000103 R11: 0000000000000246 R12: 0000000000000001
[  626.498451][T16924] R13: 00007f6bd4026128 R14: 00007f6bd4026090 R15: 00007f6bd414fa48
[  626.498560][T16924]  </TASK>
[  626.499181][T16924] ERROR: Out of memory at tomoyo_realpath_from_path.
[  626.788209][T13882] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40
[  626.802330][ T5682] logitech 0003:046D:C29B.0027: input,hidraw0: USB HID v0.00 Joystick [HID 046d:c29b] on usb-dummy_hcd.0-1/input0
[  626.805646][T13882] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32
[  626.849235][ T5682] logitech 0003:046D:C29B.0027: missing HID_OUTPUT_REPORT 0
[  626.852760][T13882] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config
[  626.907165][T13882] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66
[  626.929038][T13882] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9
[  626.972204][T13882] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024
[  626.991512][ T5682] logitech 0003:046D:C29B.0027: probe with driver logitech failed with error -1
[  627.004651][T16928] ==================================================================
[  627.012823][T16928] BUG: KASAN: slab-use-after-free in report_descriptor_read+0xb5/0x100
[  627.021187][T16928] Read of size 24 at addr ffff88807800d2c0 by task fido_id/16928
[  627.028933][T16928] 
[  627.031352][T16928] CPU: 1 UID: 0 PID: 16928 Comm: fido_id Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  627.031381][T16928] Tainted: [L]=SOFTLOCKUP
[  627.031389][T16928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  627.031402][T16928] Call Trace:
[  627.031410][T16928]  <TASK>
[  627.031418][T16928]  dump_stack_lvl+0xe8/0x150
[  627.031450][T16928]  print_address_description+0x55/0x1e0
[  627.031494][T16928]  ? report_descriptor_read+0xb5/0x100
[  627.031514][T16928]  print_report+0x58/0x70
[  627.031536][T16928]  kasan_report+0x117/0x150
[  627.031556][T16928]  ? report_descriptor_read+0xb5/0x100
[  627.031579][T16928]  kasan_check_range+0x264/0x2c0
[  627.031597][T16928]  ? report_descriptor_read+0xb5/0x100
[  627.031617][T16928]  __asan_memcpy+0x29/0x70
[  627.031641][T16928]  report_descriptor_read+0xb5/0x100
[  627.031662][T16928]  ? __pfx_sysfs_kf_bin_read+0x10/0x10
[  627.031676][T13882] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0
[  627.031682][T16928]  kernfs_fop_read_iter+0x434/0x6a0
[  627.031712][T16928]  vfs_read+0x595/0xa80
[  627.031793][T16928]  ? __pfx_vfs_read+0x10/0x10
[  627.031846][T16928]  ? do_sys_openat2+0x14e/0x200
[  627.031920][T16928]  ? kmem_cache_free+0x182/0x650
[  627.032022][T16928]  ksys_read+0x150/0x270
[  627.032070][T16928]  ? __pfx_ksys_read+0x10/0x10
[  627.032127][T16928]  do_syscall_64+0x166/0x520
[  627.032175][T16928]  ? trace_irq_disable+0x3b/0x140
[  627.032234][T16928]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  627.032287][T16928]  ? clear_bhb_loop+0x70/0xc0
[  627.032341][T16928]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  627.032387][T16928] RIP: 0033:0x7f95794a7407
[  627.032430][T16928] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  627.032468][T16928] RSP: 002b:00007ffcdc821e10 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  627.032519][T16928] RAX: ffffffffffffffda RBX: 00007f9579c6b880 RCX: 00007f95794a7407
[  627.032554][T16928] RDX: 0000000000001000 RSI: 00007ffcdc821e60 RDI: 0000000000000004
[  627.032581][T16928] RBP: 000055e5163d5730 R08: 0000000000000000 R09: 0000000000000000
[  627.032609][T16928] R10: 0000000000000000 R11: 0000000000000202 R12: 000055e5163d4930
[  627.032637][T16928] R13: 00007ffcdc821e60 R14: 0000000000000004 R15: 000055e4f87a54d8
[  627.032685][T16928]  </TASK>
[  627.032702][T16928] 
[  627.062336][T13882] usb 4-1: Product: syz
[  627.063177][T16928] Allocated by task 5682:
[  627.063195][T16928]  kasan_save_track+0x3e/0x80
[  627.079660][T13882] usb 4-1: Manufacturer: syz
[  627.083108][T16928]  __kasan_kmalloc+0x93/0xb0
[  627.083147][T16928]  __kmalloc_node_track_caller_noprof+0x4c7/0x740
[  627.198331][T13882] cdc_wdm 4-1:1.0: skipping garbage
[  627.209739][T16928]  kmemdup_noprof+0x2b/0x70
[  627.209776][T16928]  hid_open_report+0x1fa/0xf00
[  627.209865][T16928]  lg_probe+0x29c/0x890
[  627.209910][T16928]  hid_device_probe+0x46a/0x870
[  627.209926][T16928]  really_probe+0x254/0xae0
[  627.320381][T16928]  __driver_probe_device+0x1e8/0x360
[  627.325693][T16928]  driver_probe_device+0x4f/0x240
[  627.328596][T13882] cdc_wdm 4-1:1.0: skipping garbage
[  627.330735][T16928]  __device_attach_driver+0x270/0x410
[  627.330760][T16928]  bus_for_each_drv+0x258/0x2f0
[  627.330856][T16928]  __device_attach+0x2c4/0x450
[  627.330873][T16928]  device_initial_probe+0xa1/0xd0
[  627.330891][T16928]  bus_probe_device+0x12a/0x220
[  627.330916][T16928]  device_add+0x7d7/0xb80
[  627.330932][T16928]  hid_add_device+0x272/0x3e0
[  627.330948][T16928]  usbhid_probe+0x9d4/0xde0
[  627.331017][T16928]  usb_probe_interface+0x653/0xc60
[  627.331087][T16928]  really_probe+0x254/0xae0
[  627.331107][T16928]  __driver_probe_device+0x1e8/0x360
[  627.331132][T16928]  driver_probe_device+0x4f/0x240
[  627.331152][T16928]  __device_attach_driver+0x270/0x410
[  627.331172][T16928]  bus_for_each_drv+0x258/0x2f0
[  627.331196][T16928]  __device_attach+0x2c4/0x450
[  627.331215][T16928]  device_initial_probe+0xa1/0xd0
[  627.331232][T16928]  bus_probe_device+0x12a/0x220
[  627.331257][T16928]  device_add+0x7d7/0xb80
[  627.331273][T16928]  usb_set_configuration+0x1ad8/0x2180
[  627.331289][T16928]  usb_generic_driver_probe+0x8d/0x150
[  627.435087][T16928]  usb_probe_device+0x1c3/0x3b0
[  627.436222][T13882] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device
[  627.439966][T16928]  really_probe+0x254/0xae0
[  627.439991][T16928]  __driver_probe_device+0x1e8/0x360
[  627.440011][T16928]  driver_probe_device+0x4f/0x240
[  627.456131][T13882] cdc_wdm 4-1:1.0: Unknown control protocol
[  627.460718][T16928]  __device_attach_driver+0x270/0x410
[  627.460744][T16928]  bus_for_each_drv+0x258/0x2f0
[  627.460768][T16928]  __device_attach+0x2c4/0x450
[  627.460786][T16928]  device_initial_probe+0xa1/0xd0
[  627.460803][T16928]  bus_probe_device+0x12a/0x220
[  627.460825][T16928]  device_add+0x7d7/0xb80
[  627.460840][T16928]  usb_new_device+0x9aa/0x1690
[  627.460937][T16928]  hub_event+0x28e8/0x4d30
[  627.460952][T16928]  process_scheduled_works+0xa88/0x14c0
[  627.460972][T16928]  worker_thread+0xa47/0xfb0
[  627.460991][T16928]  kthread+0x38b/0x480
[  627.461014][T16928]  ret_from_fork+0x514/0xb70
[  627.461038][T16928]  ret_from_fork_asm+0x1a/0x30
[  627.461064][T16928] 
[  627.461070][T16928] Freed by task 5682:
[  627.461079][T16928]  kasan_save_track+0x3e/0x80
[  627.461103][T16928]  kasan_save_free_info+0x40/0x50
[  627.461128][T16928]  __kasan_slab_free+0x5c/0x80
[  627.461153][T16928]  kfree+0x1c5/0x640
[  627.461172][T16928]  hid_close_report+0x632/0x720
[  627.461196][T16928]  hid_device_probe+0x5bb/0x870
[  627.461211][T16928]  really_probe+0x254/0xae0
[  627.461230][T16928]  __driver_probe_device+0x1e8/0x360
[  627.573185][T16928]  driver_probe_device+0x4f/0x240
[  627.578237][T16928]  __device_attach_driver+0x270/0x410
[  627.583639][T16928]  bus_for_each_drv+0x258/0x2f0
[  627.588524][T16928]  __device_attach+0x2c4/0x450
[  627.593306][T16928]  device_initial_probe+0xa1/0xd0
[  627.598359][T16928]  bus_probe_device+0x12a/0x220
[  627.603255][T16928]  device_add+0x7d7/0xb80
[  627.607654][T16928]  hid_add_device+0x272/0x3e0
[  627.612358][T16928]  usbhid_probe+0x9d4/0xde0
[  627.616887][T16928]  usb_probe_interface+0x653/0xc60
[  627.622034][T16928]  really_probe+0x254/0xae0
[  627.626607][T16928]  __driver_probe_device+0x1e8/0x360
[  627.631936][T16928]  driver_probe_device+0x4f/0x240
[  627.636998][T16928]  __device_attach_driver+0x270/0x410
[  627.642409][T16928]  bus_for_each_drv+0x258/0x2f0
[  627.647296][T16928]  __device_attach+0x2c4/0x450
[  627.652088][T16928]  device_initial_probe+0xa1/0xd0
[  627.657160][T16928]  bus_probe_device+0x12a/0x220
[  627.662049][T16928]  device_add+0x7d7/0xb80
[  627.666406][T16928]  usb_set_configuration+0x1ad8/0x2180
[  627.671892][T16928]  usb_generic_driver_probe+0x8d/0x150
[  627.677394][T16928]  usb_probe_device+0x1c3/0x3b0
[  627.682269][T16928]  really_probe+0x254/0xae0
[  627.686816][T16928]  __driver_probe_device+0x1e8/0x360
[  627.692132][T16928]  driver_probe_device+0x4f/0x240
[  627.697185][T16928]  __device_attach_driver+0x270/0x410
[  627.702589][T16928]  bus_for_each_drv+0x258/0x2f0
[  627.707462][T16928]  __device_attach+0x2c4/0x450
[  627.712251][T16928]  device_initial_probe+0xa1/0xd0
[  627.717324][T16928]  bus_probe_device+0x12a/0x220
[  627.722209][T16928]  device_add+0x7d7/0xb80
[  627.726610][T16928]  usb_new_device+0x9aa/0x1690
[  627.731411][T16928]  hub_event+0x28e8/0x4d30
[  627.735855][T16928]  process_scheduled_works+0xa88/0x14c0
[  627.741416][T16928]  worker_thread+0xa47/0xfb0
[  627.746036][T16928]  kthread+0x38b/0x480
[  627.750140][T16928]  ret_from_fork+0x514/0xb70
[  627.754767][T16928]  ret_from_fork_asm+0x1a/0x30
[  627.759563][T16928] 
[  627.761907][T16928] The buggy address belongs to the object at ffff88807800d2c0
[  627.761907][T16928]  which belongs to the cache kmalloc-32 of size 32
[  627.775811][T16928] The buggy address is located 0 bytes inside of
[  627.775811][T16928]  freed 32-byte region [ffff88807800d2c0, ffff88807800d2e0)
[  627.789407][T16928] 
[  627.791750][T16928] The buggy address belongs to the physical page:
[  627.798195][T16928] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7800d
[  627.806978][T16928] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[  627.814129][T16928] page_type: f5(slab)
[  627.818158][T16928] raw: 00fff00000000000 ffff88801b004780 dead000000000100 dead000000000122
[  627.826768][T16928] raw: 0000000000000000 0000000800400040 00000000f5000000 0000000000000000
[  627.835372][T16928] page dumped because: kasan: bad access detected
[  627.841811][T16928] page_owner tracks the page as allocated
[  627.847548][T16928] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6703, tgid 6703 (syz.2.251), ts 136506433821, free_ts 136503203358
[  627.867114][T16928]  post_alloc_hook+0x1f9/0x250
[  627.871910][T16928]  get_page_from_freelist+0x21fe/0x2270
[  627.877480][T16928]  __alloc_frozen_pages_noprof+0x18d/0x380
[  627.883324][T16928]  allocate_slab+0x79/0x5e0
[  627.887864][T16928]  refill_objects+0x2d5/0x350
[  627.892562][T16928]  __pcs_replace_empty_main+0x2c3/0x6b0
[  627.898125][T16928]  __kmalloc_cache_noprof+0x3ab/0x660
[  627.903522][T16928]  kmem_cache_free+0x156/0x650
[  627.908395][T16928]  tear_down_vmas+0x312/0x520
[  627.913117][T16928]  exit_mmap+0x4ca/0x9f0
[  627.917382][T16928]  __mmput+0x118/0x420
[  627.921489][T16928]  exit_mm+0x221/0x2d0
[  627.925586][T16928]  do_exit+0x6cd/0x2360
[  627.929798][T16928]  do_group_exit+0x22d/0x2f0
[  627.934416][T16928]  __x64_sys_exit_group+0x3f/0x40
[  627.939465][T16928]  x64_sys_call+0x18c6/0x18d0
[  627.944166][T16928] page last free pid 6703 tgid 6703 stack trace:
[  627.950511][T16928]  __free_frozen_pages+0xc22/0xd20
[  627.955644][T16928]  tlb_finish_mmu+0x13e/0x220
[  627.960349][T16928]  exit_mmap+0x4b2/0x9f0
[  627.964607][T16928]  __mmput+0x118/0x420
[  627.968680][T16928]  exit_mm+0x221/0x2d0
[  627.972772][T16928]  do_exit+0x6cd/0x2360
[  627.976962][T16928]  do_group_exit+0x22d/0x2f0
[  627.981584][T16928]  __x64_sys_exit_group+0x3f/0x40
[  627.986634][T16928]  x64_sys_call+0x18c6/0x18d0
[  627.991345][T16928]  do_syscall_64+0x166/0x520
[  627.995957][T16928]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  628.001861][T16928] 
[  628.004205][T16928] Memory state around the buggy address:
[  628.009847][T16928]  ffff88807800d180: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[  628.017930][T16928]  ffff88807800d200: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[  628.026015][T16928] >ffff88807800d280: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[  628.034098][T16928]                                            ^
[  628.040256][T16928]  ffff88807800d300: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[  628.048332][T16928]  ffff88807800d380: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[  628.056402][T16928] ==================================================================
[  628.082502][ T5682] usb 1-1: USB disconnect, device number 42
[  628.102121][T16928] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  628.109382][T16928] CPU: 1 UID: 0 PID: 16928 Comm: fido_id Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  628.120077][T16928] Tainted: [L]=SOFTLOCKUP
[  628.124413][T16928] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[  628.134485][T16928] Call Trace:
[  628.137798][T16928]  <TASK>
[  628.140759][T16928]  vpanic+0x56d/0xa60
[  628.144799][T16928]  ? __pfx_vpanic+0x10/0x10
[  628.149339][T16928]  ? __pfx___schedule+0x10/0x10
[  628.154226][T16928]  panic+0xc5/0xd0
[  628.157986][T16928]  ? __pfx_panic+0x10/0x10
[  628.162438][T16928]  ? preempt_schedule_common+0x7f/0xd0
[  628.167934][T16928]  ? report_descriptor_read+0xb5/0x100
[  628.173419][T16928]  check_panic_on_warn+0x89/0xb0
[  628.178392][T16928]  ? report_descriptor_read+0xb5/0x100
[  628.183886][T16928]  end_report+0x73/0x170
[  628.188161][T16928]  ? report_descriptor_read+0xb5/0x100
[  628.193657][T16928]  kasan_report+0x128/0x150
[  628.198199][T16928]  ? report_descriptor_read+0xb5/0x100
[  628.203665][T16928]  kasan_check_range+0x264/0x2c0
[  628.208604][T16928]  ? report_descriptor_read+0xb5/0x100
[  628.214092][T16928]  __asan_memcpy+0x29/0x70
[  628.218542][T16928]  report_descriptor_read+0xb5/0x100
[  628.223871][T16928]  ? __pfx_sysfs_kf_bin_read+0x10/0x10
[  628.229358][T16928]  kernfs_fop_read_iter+0x434/0x6a0
[  628.234586][T16928]  vfs_read+0x595/0xa80
[  628.238748][T16928]  ? __pfx_vfs_read+0x10/0x10
[  628.243444][T16928]  ? do_sys_openat2+0x14e/0x200
[  628.248302][T16928]  ? kmem_cache_free+0x182/0x650
[  628.253263][T16928]  ksys_read+0x150/0x270
[  628.257523][T16928]  ? __pfx_ksys_read+0x10/0x10
[  628.262317][T16928]  do_syscall_64+0x166/0x520
[  628.266939][T16928]  ? trace_irq_disable+0x3b/0x140
[  628.271985][T16928]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  628.278049][T16928]  ? clear_bhb_loop+0x70/0xc0
[  628.282725][T16928]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  628.288630][T16928] RIP: 0033:0x7f95794a7407
[  628.293045][T16928] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  628.312650][T16928] RSP: 002b:00007ffcdc821e10 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  628.321062][T16928] RAX: ffffffffffffffda RBX: 00007f9579c6b880 RCX: 00007f95794a7407
[  628.329035][T16928] RDX: 0000000000001000 RSI: 00007ffcdc821e60 RDI: 0000000000000004
[  628.337003][T16928] RBP: 000055e5163d5730 R08: 0000000000000000 R09: 0000000000000000
[  628.344982][T16928] R10: 0000000000000000 R11: 0000000000000202 R12: 000055e5163d4930
[  628.352971][T16928] R13: 00007ffcdc821e60 R14: 0000000000000004 R15: 000055e4f87a54d8
[  628.360958][T16928]  </TASK>
[  628.364601][T16928] Kernel Offset: disabled
[  628.368950][T16928] Rebooting in 86400 seconds..