last executing test programs: 15m13.94633192s ago: executing program 3 (id=1537): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000040)={0x2, r0}) getsockopt$inet_pktinfo(r2, 0x0, 0x50, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r4, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r5, 0x0, 0x0, 0x7fffffe}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r5, 0x0, &(0x7f0000ff6000/0xa000)=nil, 0xa000}) munmap(&(0x7f0000fff000/0x1000)=nil, 0x1000) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r5}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) 15m12.483285203s ago: executing program 3 (id=1540): mkdir(0x0, 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) socket(0x1d, 0x2, 0x6) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) syz_emit_ethernet(0x4e, 0x0, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c000000150a010200000000000000000300000a1100034000000007040008000c0006400000000000000004ec77a585a665796f10fbb44be6cb9691fbd7509ca5214f7686147ef9d0094cd00101c19027fb2176acc6d3db8f476c2fd7e4e48829f250d03ba2a821f8b002b644102d1eb23a7ff3689b469a9826aa0e051e2ecefe44f4f30c14e126479a8bc1f3f0b07b80cc4f787537739e52647d294defb463cffc06ed2703036588ed2fbf08059123433bf36439576dd187ae7d554e56641c00f47eaa1a39a262c84a2c4f28011de0c3a63e8f0c3e245023e3b244d5898d2b6ea38df7f2c73954c7dc1bc95880142b3be2be4a6bb22549b22c82b727f6f4d7225f4bcc72b5454b6fdeb03beda295f36278aa6c915cbd5515e8"], 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x20004044) openat$cgroup_subtree(r0, &(0x7f0000000200), 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x2000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, 0x0) 15m10.05645823s ago: executing program 3 (id=1550): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000000c0), 0x10) sendmmsg$inet(r0, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}, {&(0x7f0000000200)="e00a", 0x2}], 0x3}}], 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x181942, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r3) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)={0x3c, r4, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKMODES_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_LINKMODES_OURS={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_MASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x82710}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004000}, 0x4044094) mount$fuse(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x1002}}) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100, 0x800, 0x0) read$FUSE(r2, &(0x7f0000006380)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r2, &(0x7f0000002300)="00e7a0633e8438bafa888b9b02144af32e296a0a01dc194d649b6fa26d6d5e63bac4a04baeeb8aacb22c6eec461b67db6a737737c6d2687acb00572f92e3fdb5d0cb2f11121c557a943020200755bcab77b39c406b733239e2bb1175b9322ba39dc7d67da8f77aed1714dae2e6c24c3ea96be9d151c6ab7b3c54bbe507b8b2461fb4be8dc90042184af6d48f8ace16abb5e3fc943cf61cdb75624a259bdb5f7829b9775820f85f2d1a6ee6c6c2af4fd41ab8a41ecb2612abf13cd2c6f9f3e6db505e4bbe68cc000cf5fa6d5636191a4b366ab59af52132a3f9678d4ed1bd577bacffb3b52850804005eebf3dfa4763168ff30490a11acdbbf4c3312a45f30139f6b72b1e7cdec185006bb30e0e8fa88da2cefc718cae7e9830f7ca101e4e23c6bd16bfacf4a9927fb13af4b79c86ab999beda4ad396abdda354a42fb4ef21d6749175dc21a0cf9191aa4f90d274b50370a580ad8dcd166d2b06c0d8b071973c3fde30f7e2bc371a51ca5866bf8b24eaac75bf482dd4436b214ff62d32e20df223b0b680ede28b3a49e66e330a8a3ecace0db9855d235d5ff23765e742d1a739c2ac8743f4c62664a3b347279da55a1a5b16e1e2828b584a013577d50f890e3894d9e8d6bfccdfb2b70221f12a7fac24b7a8818edce72b65f622c77bf1312771a2c0d805ec9a25c536c91868762032255be78903b77b2c1a773a03996fabba69214e76f5df6df0375b592692a2c3c86c75a3be56fe598ddaea0b9901d20db7e43e128e04e5509283f833c24c625887288459db5727210ba9a301fb8c934dd1d8dca68039fe5b2e1a8d7cdfc6d875e5851098100c3cd42544ed90bb55b58d20a501fabbc485d148c615a3b070fa0520da2ed68ee115a4411d5418b47f3d95616096f67a7a36d68f1e8df82eca8ef96fb4a96b3422fe046a37ea5f5967513a559bd770fecab7228b0692f439765c9e9c6ea4fc608e0b27f9b49064daa2bac06f83f6d87ebc61fa3a29bb5ed39641245ce8cf43770df32a84838802b0827ca5a40e2003915e2ed108a005637bb028d29bd2cfd28a1bd55e67ed1b6b7b72163c27c4b0e36d1b134d6dfdb165a66fb46498fc04bb8053b84098af5b18758631d1318d625a6fa4d3ce5a4d3a90e10c6363a26b5ae96c2d56f87ad21a6118af6847d041f88f852ddc3f250c088ef5cb31198f3ac81cff9a5bab26ed56c09f8416188974e08349f7da28fc754b98c1ac4ea0060ac1e1b1c49f7dbadbc59254b265dc418cab9ac14e2bbecc4c3103543e37984efb1f61315e10d2b422732217d3a9b0cfe4561f3765d3bda60be239e02bdc164dd631582e8c87dd8fa60d63dcf9e7f3dadc4ce5e4433a42425b8ee8cb8a2defab0bf9b6109c90b5655b79b18c06884f2670a985d454e08e54de69f645cb0cbb70620bd988ee717c310ae77b4abe81c01c6e7f47268ee20bc30b9062830917705682eba2c5ef966b877f33294aa5f8b29d3dd5ed92302087f34fa18d19a005de05f925e3e93c8c0f24507ff20cd23d9ae5452c32ff58c78ccdb1ab32c98edfaa6d2c3971934ca8f849ac360c286566eb72b0793f12cef84bd282368d533247ee750f18aeda484167f3d680e4aaa3aa0694441d4ff6a71531f1a30f87eeb71afd04c5d686e1f86f27586f4e2c8ff77c09612ba1af9b3fb93efd31af42f8e0498f35d07c662b743a08f2839cad8f95b90cbb4fc0ed2ca45dd093a549cde4c6ff08ce09a2cbc6f9f78b6f96643357f92f8f403202742057731fd3e343a87c0affe803cfdbddb8c2694ab63f2dc35da705624747e30a943000fc82c40f10e1975d2e2ec15aefd531b6dbc053606b054dc976f44d5b5a5f37e9c08532ce16cf8bca55ab6c814ceb855ab50b8b52620f8645a9dc25fcb732080d84bf39c3ebb235b4d96da527b64ec4b72f69e91d16a4efcaf76f2e1f968ca68a06f60b01ec7becc9ffd7877c0992cb0f80fb3daabc039513896bd7697843be06aba53e7761e11e075c61ef2d897d4d9f90041c14283746feeb3f0d456ba4be27843350fe43e7c1110b4439489139f6dae01c43f23ec71f08d3042663c65e059d368e4e2c6e49de45bf078d3182a1bc1208bc59379e705aa3309579947409f2a8b3d79099c8619f916e7a6fa333d2312a274247156b8c25cbcfcc59ef13339c700f56a8691dff39bd4338789001872c0d90929037dc0ad99b380a6ba73f331f73f9274f4c2bf5233d7482edf37bf6ffed4f2c0ee44a1d57cae0d644f25591dc03bf837571a82d0c31b61be7ff85a5b3843e8f96a50eaa43f5c137ecfc4e4530d08a2afa4ba02fcc50117a4ad0d5862302017639344c82749f673dbd650e49b35302d0acbab45c0973198291bb42b4cfcd3b0c252074341ea8eca19e122cd234da6d41bf5eedb706e16c17687ed8b84db67130796d26b94eac83bbcd785b603242bd6252c155711efd7dd22cc54e1eaf6d910d0f22c701f3d4da0314dd2829c6ee13bbcbd126558b47b8066bf0766c792a012315bd29bfeda8f28a2c1f4e638b701758e19a0e5bd5b4f19048b00a877d956292e345f8a3a8367892f955bcb5e50ca145ec5e2c9309e25941bd277e393aaad38f9b72a42514b27da6856223c37a1fc1327fa760551d3fdeb0b222ab180b16c9eea138cf4f327e88fdfee293c5b6b007028eb796a60772148282dcd17ffc1c90ed8b6540ede933545ed5a5301d6ff39734444ff3d85cda4ac3befa5083a4685e9e231eba4a91a35f4f7f48fd5ac2447c64c010e2a9f8e80691c95460e1995444466ec5f3cd71fe509a26ff0b7f3254bc8c3255e903834e841b37c70b267fb33deb0d1ed4ea84a869453ba508fc255b12cf847103d5195046c930ae4a75c956f22fcfe4186d547686b54bd7a534940d5d62216994eac0e8ed3bd2bd59354e6b9c6b5b10511d54a8b928040f1e1024a423b0cf519fc6e9673df5c48c0778c7edb8fa8d8ace77463a77d2d6313160e1ee72742953e433b6732ced59c93464fd91520847db238610ed0c289fc55647881a7d6257cf28090c75a6f19df079cfd35742a74a5ab270314f7c8039c20ff0f3f543d029b75a741b5dc6425241ac2ffabf1f96288e6d4ba34da09fb6049c2c8753fbd41fdb4bc68c57bf374ef4feb0df00c41319debb26afba2ff39e1799a1c2137f4e920ee5b02d93789b6b0c853e8143dae5b08ee85da2ea7c31803610ce797293ea95c16ade6dae2afb008e59d8b9505737f008b5227df5f1e4eb5d707f502698a17ead9b1f5ec09dff34248ff2fb153dc6df4812e39754a4baa42e1d8b77fbddef3ca091701ac28ae5fd422dbd8db5b122d3965383abc37a52d2fca5ce56eba974dba3d059cefe40e3c35c9daa8ae31198214303c1dcb90d58fc983ccfd504fa43925636f94b128d44e8aa5cd3ecfabd50a84062d03f7508a0575ab65ecc749d3ef566fdbc529a8139b7a7fb3a9bd784df52cddc6f2699044ba47615163fbbe19f3d88d38a8b71fe52b2611ca74341429d1cef1a7e350545be29d2caa560e60352cab074c298c44ca2c07f9795ce52f10aa3e2fcdef371f24e309b19e52218881f25a4674527edbe3b3bd0b9b536d810c6f9500c0c81bcfd9a440dd91c1d35c52758d2b2ae1a8497bb394c4f09d3947cf777727b0d1daf5ac4fe4fa3c247a791702cb84b96321b7fec81bf549d4eb5d6dafe019b26187417c68b064e4308908535a3e77b6cd3e28caaf12d726f15590b7958e40134d045a38cbb689131a7e85532f1c63dd4bac9e4d00645cd7b2b71704563f3738b92044a8153f6ba717800ab7cb238175c376d7add2c5ec38e4c856f1ab9c3ee33f6ca6d576ae908dd290e4bae23470182e253765e04e8eb02a791c4396a511ef467879a9e2818b8a4b1b0b39a6c44e816e3ebf6e3be93929dfcb38d5dad7d20b60215447674d0608b8b02331ac20e57083cb9b4449fecbb149441aea0ad82f00a82d87d743fc80d410922bc20923516885440f43c9f32beb81ce148def6140952583a7825c2d2fe012d52d30ef66d32a8a0864ac5c1737e2506228d41ff0515ee80be4cf012927dde0fd2a07cac68eff8c4437f2844d4df07936fd8753e5909f962c5c767f8719cc295bdfa8a16f3f36ff56e34d7b14b6b8c46d5af248b04a9c5396f84990e23d145670950bce5f5638e5e2cea37c371a4483729338f1305cbb32fa1c05dd9d21d2a69e5fa3abe9a2dad2237be20b4088393c04aa66cf13718de4bffac72f641a8c017a1d5568fa15a6a06e4dc833874ec95af6f115bdadf15179bfc8c4e3e64f26f1299e282c4ab397340934efc1e601afc630fe195e8ae7d8da1310568cab4f2fad085d0ec39710d8b7c812b3fd55c6f50925bcfc90fbcb35b8daa0f1e1f69d82fae2034039f7ad6921694ed48a55a68bc541e6d86f1e33c261a92d48b50eb58a03d8e31b2f6564a4ddc3ee988d0dc47b4b610a9a9dcb87571b5c1edb3362df0ec3d58872157e0f7247dfa8100b4478b705702a5620c9201010f40232327550db333e845dbecd6aadbd0a94c064862b1100b4dd45ece811b8c0275e3753e11b4bcd8bc5ed7668e72afa5bc5cc17b4c313273755f532ecfdefdf2d5c47999453a3b7c158d98332f0bd3a820cfb2c8c3bcd43197e7395a032cec6e41662079f2f654965aebc393e22b5c8516d9b8ad01e33ee481a4ac46a2df304dadeaa9e5274d340aaebe14dcea315fe1279f1a41a5c7aa8c94bf4b3d48757503171f53488e01210145e62c0de7c39737848dbdb1b207d4d33b8de180b020e8a76b1b521905e5e3ce97292f8558fb68efdee774681bfffcf1dc3eef35f660dd1659a32950de2d50e762313beee330d9c2a9fe8ce5e4e61ddd86378d3551335f6ef62053d3b248a8c33a11abdf3f3aa1975a15f4a6957a13d5b12a44d0f2b52b9a2d996e98c630c0f2abca80c7ae89efcf81ae284a0d19582cb1319d207077e5657d245533181ed6e07e0f7647123fc46c37bd75b4f4d181112b4a08acdcf445332cb9dde69a0923dd9244dd2ecd818b19588939922e3b2d8dd9d9fed95fa55b0e4564b38aca2c4d24eebc634664400177fbdeaeb278bb1d8eb11baf4be5c87d4f8d9a855bfa75df4c51fb4eec87a27c59df9a47d82523b08022a1c0fb22ff6f93c3d2cc22a4111a6ec5be428cba33617be65739c2240248f3a02d01ddf2d6aca9e537a2296b16d082d2b868504371dd5e41898885b03ebfaca73b40e8924ece83c1c80de6ce14943e1199c6f81bf359f44c3ed5ae3c6eacb730b1039f0b6555347bd566dfff45a7a2176420ab2b40916a73b66a3ad07af6e1ac5597393d203fa1ad34d4564af956a0a3e2997e27a4e5eff67dd89cce8875d995e00c1858234f149f6ad4cac2b8056966f726df57b8c4ee8f22f23097ba1471b1f1036e3a499400fccdb75b56eb13e9eca1407d5bff4b075b06d00fcbfcafc28431eb33156232e73c6577e3eca437330c494ede57b9609e1f40634918dea767338b5542197410cdc000143ace89ca0b7bf645b3267f74767d7c7fce05d2f59c137204e56bfa711f66903c511f681cf7a1b4f9fc0f42b7c438ff8957e1059375321df5b0c5c884f46d94c21686e1300582d34928bc398653118f79bfeea2e7cfbbf31a7718f4aab50fae57db94203d43e060365c9a7455241be03d82dffc3783d0f6aa170c0866eb0dad07485831526922d8348a7a16e2e9903a2ac93c58c6dce83127fab17703ec004a519ae5675baffb31bf4b52f9ca992a84017a44d68dc693abd829947342f277fdcbc87168bcc03c32b8b1e81a1915af2517c464af07d52b79d1b0e53164c82ba049f81e92ed1dc20a88fd72e9ce7aa4b22a7cc57dc5527d14f62bc29cfc9d57ed26fd523cac39ac00ba12d3a49d694709924275fc0793d56acf9558818dc9eb210749fa5307d45886b879257d627cee0542b51c2ce6ce134100efb47c92456ece5b73cdc051f570810a8d534222649eb56cf73a377162b753de6c282bcd4a25dda21dd10901bd8dfe8fd4ba8a70811c39707beded23dd60f23e2933372e3a6bce099899b07f0a4c4956fd98e956a8649622c77717de099463c0c6c9389ab4a1ae10f8ddd086d876af2943ee0b6b402ae5f89e09922e8c510ec0caa0a83e366e916400bfec88a52ab457037a35ddc6a8e2289c33684a5915c37bf5d227cbc65a737b52bdcb4fbbb7b4e7f965db116b46044d0870846c730dce12e120b1fe6dd5798ced24cad72c59a3f44de4978b8bc05a1dbeb766be6e2abf6ef46c67a58a370e54e92d89e5f44525e82b94a388d8d0cb20c3469a258c1633c9dddb6854aee255f93f59435ff317622f6899250aa185c207644275278580c5d32401741fe264a2e03b80f442ed58fd0704ebac923ac6a5abb7f0c695252f82e3fbcf2b99d721589a8fe3fad4d5926aee3d7bfafb6739e525faae3d25b12841fa2cc61dddc44d36acb9a8b72d60ecdd9c8cf04f9bac341b5e0f9bc59042db8126324888b07afe72b18cce36d61eec975b6b4ef5dc4a16ac14440cf770599bd4db630bd110eb63a03a80cd95c16d314a4de60cc5115bf0754cb7ab84a827ecefafa96069c721a5979f227fdc2467b4cd1975dafb5b28e1d6f3c1c3a2816ad831dd98c1378a03798c128f176426eaa0e361571e758d54bf4ec2c988355f016e16d6cd5cf97bb4891ab33f5623b7e796af313cc7a9e2f9510cd2bead1ea5dd080d9de1f595b2629ebccf69a0feaed3963ae8a6c89edd66fbf6e566379898185828925f8669668d6bddff961b08aaedbbe7fc196931a887ec740da6bcdab8f826a34aa2aa1e406a258558f3baf022a64222df4d6ee8726c79ba3dd6e11a19e4b4bb49b4a8cd99c189e6392f08ad731e415b65d0ccb919dca46efe9f79e21437111ab09e926d3038182044ae047bf1cc92e2d2644c528985719667a1a8abaf65d0f211172ea789b2fa016e1a88325d1ed706239da4dbb9e2079e3598b4ae5885667587ba1e0921c9ba55d7a3be4c47bc2f2f3547ce9efe32e5a22855f761bd4cbe1cd9337eda4bd7d82a918084d7e116b656104ca87e64b1b8c62323c3c296c5b5b98051feb607b872edf9f789744aff710c4b7279711182bcac6b76c05f5cd982f52f451e7e29046550e012e01d8cdd3e305427030f4247488c9136303084c12175c5c781cdd08aede5a356ea0ccdd05a460be3c7b4bfd62c3ce9ab68e285a36c1546d0b18edad71f69f5bedb340772e1bbb035514b085067259e39f59dc292a12557350c66904b253efee29a5eb7a6920f583c899dc46a1d3e2af2db3a3d1a0e8d1f98722a16c6cc1e401058d60c8c436d8f1166ba53bdde5810f9d0288528affd486c266546a864c92af3df8abd451cc1e0d6bfea534865cea9d49b3ea5e390fa823118df8a61e31022f5fbb8ceee870bf2e60890263c4d14e24d053d0fddf665ff80a66fa00a5957f8a30fe82a4b82cf2f6b4d49def98f66bfcdaa0aef13314e950ca9f3849b1edf3b82eaf74a0dbcf45c3dba9bd2d853281a78484f1efaf4150da1207ec3cb61fbcbf759f8182b7052b28d7164b73197b0a440759fe9d5ddf827f1897a174e82fb968a9a07c61bee44bc1f7f9ee5c6de04c02d57735c5fab741b36aec7c8642e56cba932a08b8e8a9d3eb066a4ee7cbf22e5abbd4346de59eca1f24ad9f7f9ff7621e5f30dd08f4cddda8e80e496908109f5212a72bab1378d1237def07bdda4178719975346c68405de15153031fb17535894e5e3c1de6fdd507333f0226b78ba7cae509cfb48d6735ede9392650bf85ac1db919b1e9fe0a823119d8253204dbb2f7a8f524be6d419f3a45c5051a7a88ef0bd41586d90c11a894d647f03895f671a6e19f1c70e32668653aba8366a3d372522f49844081a9637db080663ab02f4a8af502955d5411461b62f85308c91852f8fb9f0bdddd500b4a133791d3a2f91a82dc4b09f5ad2196a9172ab0cd3fafe7266e9f6d159110d99ca8da8a34b17be17a04ad4509a9fffab1e45e10f10e0cf9cfbd9c761ad044064c07e473fdc626289cfb88b13a11455c069b70aa02426d9119ac878a14c9483be9c0d5bcbb5fa76c8d06531f59c7cf7c26372e750e2f332418ca769e5e7fbeb3ada7bb58b573a0635e2e3ad9a53ddb809ea01086a3fa993ad57e89da6f9c5e61bd0f8ba69212a386b2aa1ae17520d7fb989dbe14021885eb50fa3048aebd42c861a09a308b660d382c0480ead8a52a1e14927c7c77957f94bb59ccfd557f8c4a7af23360a298a603d20ebc386db041d8c306b3e32b0bff541bdec5ff75c3b40950815cf9f89d48a382f67e44c409d046c01fb1262aca0df6f5238a3c3c09977261494f7361ba326815d6e23f49e4d6d4b54665081067332265fff59cf54af9da0db9d19bc611cbcb6e6f3f1e2e1ffb6cdd6253578d78d06a2ff5f9250f1994c5749e3ce49231fbd63bba28e948f9150933e3ae31299babaa41043b181a100882e613b4b4b8f49ceeb742d22f860853a9b917f5a323a8a1fb1f3363a7be4407fba44b408f259b5db79a055b92ce3d7a0649cc59f4afa2b1f69959d5c6f5eef1fa7987a47bee4491f685c52e9db1ee1a231ab5a4bae1019c97868a409dd0d57b32525394a233023c4a7ac429808bbcb57a34b41883202744c3bdebc0a637773273f19c2be6e806bef7fc1002846db762ee4e16867773808c5477987d5851d5b1641d070feabc203cb3d7943ffb206272fcac1bccb616352d85975f5a22c0f247548535ad9fb83fb2be17689453f10691143c060cd964df63c3c70e7b1cfc7e2b468015f327f9869353477bfeeed330b03ddd9e4e0a2441182244da283d7a59d2b2b20e6de3e3a47c26aeef4944c1190bba674523a6c3c4ed6bac53b9edffcb0e9fb19d8bf36949d03ef6a7e59eb903a00d9614f642d1932c766421906f5b177963c71e881453560e3ffcec792e8dc46b1832a8fcb2ab2268a9c1fb648d1c6fa1c8cbd50d5a2d8264fbc6c063e6daac5519d362da389dcd3d12c8039f991de91e728abf5bab95c3aef66dd8cc36c60e73cb10afb02eff6df20ff12c59b142b07fc48fe94612de80b8b958f78256fd7cf3c6f79a83867f3bb5f70da392957badadecefdf7b6e4ebd39ff945397c7d302ca0a5a3918d8abb893cd9cdd680916a50fe19699ff0476ad82e6ba46523f26ccc5eb65313c1df1077c8876d2b73bf86ba311862d12b0c557a92ef827197121512e87f817167d4b17c7e225a48b3f8fbbf4187438e0e9b78e905cdbeb72e80dfb37ec0104f5186b39b4ff34f0cdf4b74dc915acd3f98874cd6a67308d0ad9697121ac477550b1affe004f433705933f9647522be65cb5a7471120ec942aeb956f195be0c1783102cf7d842f2968222ae1a7fa6513f200d3fa85d71724956ed697f0673ee3b40a4d46ba701f71864ced67f1ed52b52b9f72906477d520c90a9f5dd49a7a33a328137a183f439895532b78ae451a8c3db789bc862fbc37241d523027e1a008629c969380f6eb55f9cf3f0675bca6851f00df6aaf90de9f62d5c179945ef81d1073850301f97e379ea415d830e3f3751cf83e2dba541cb6cdd89e6b674f2c53e329e5f3dd418d534ada6469a5b3bca5b7cfbdfdd6df4abaf77d4520d0311e801145c91b52586a56086e663841b702f52cef9fff8cfb7b33dfa125688ba6b4fadd1dca8defaf4259ca85323b23d3bbb45933562c25af3e8d7bc6ad4a50ae974f8d207994b3bd74a6812ab6a40fcaf96bb4e17bd20d742b14c72226caef3e0f5c56c4930071e9f9a894f18650fbb785c6f707605c86b634c9722c8690cf3a954f68d7c2db3a257339ade67a41259f6f878dd0ab7876deffa77f6f00819282a8f4c4da84c6cf4f335cd0410770a2b1a1fbb3f85f4489eeceb78bbfddb2d1866c57b41f6ed179a0bc3750a486403d23473f2feef43ebc5af1018d9c20089e277d77fb9c34f425c8f8af4c49864b57572fa8c232e61ef37194251a1ddc2f73ffecd57e638751cb72bcb2c40d22540166ca1e8588f24b010c9fbd962e3a2c23a7e93f131df61b8703ce326ed80cc87912d3c6aaa27574bbe8d65bcaecd660c31cead132a44b1d0e4a53cacc0b82a263c4e7783944af0af08ea9e68e8e25ed9111cfef841f1b2fd24164f9097f70efe09b1109e5cb91fe68a2760381fd63a7fd422dd578a60661abc9ee3a5db1c2cde2fb21f2040f1ed3fc27b99e254256949d0560e8b98fa028fca50768caa951a87bf8969af498d50a9ee773c9caa7d9f7d8e1955506013f198cda316d79b177e59f233b98f727afd2494fc18642f0015adab756ea6742690c7d00f28655b915ce4eb8b3ba2e8559ba23e1ff1ccc9f79ae2df85f924459c56715dec78ef4592352eb1a850cd65ecd36e1a9121e888586b7b2fa84da920b8cf44480433e61ab076b10171c0537524bb170a4b99b0b0c437418a665b7ef909652b6483b20362e557c1480c2a2a0efa221fc59054a48122b52d38245f9bd026001635be5b155f5c766a59306fbde231fa72b4d74449a2fe8fb969496ee26af5881adaafb4189b439877ab8f78709cfd32c10ea576a010bfc137b7a4aae137ea3d29070ce3bc8dbe6655e967115ca3461ad9d28b9cf8af07441e68a54ec5e889846f3978f07ba51f7d5af5da78c5c675dc5d0c1a4a399ff4247203573a46fb903eaf7bc886e6cbd3126fa4a3fe3bb13bbdfea7da871f6563aa750f6ad7895b34b2809563dcf5ed30f1c60cef4138aa49d4f55e396534ed10cf4d857723a2b442f47d79de162c30ec6c4daf939b4c88649494e3682d1da81b4a5928d8e18a16c46707a685305e592589acb484e28e9d5af89c44b6e563d125ec97c0155410527406d94b90bc9576a662db99da1cb82b04d610d02187ce08f22ea0e8fd31919d53fa6aaf980e31ca7f8610e695a41919c24136a8406c62d5f15fca365892a2b54ece17664b5247583ad60d863f283f3c288946139575dcaedc978762e85f534e56334ef0221c34ffae054ddf79339b8f08701e9699b11041df8f518dd33203363c8098fbefb01555bcc2542422777b38d8dff11b15aadb0c251ce2c5b32f8735b3cb784f2e5731b48feb5a0e791a1106abdea0f7d1f087737cbe7fdf523fa14c9be2a2987511004c5b7ac1814ef6961db16799698242452c469a07c30e4a1f73193c74a41bdd88aef50035e4648bc9dfa276951798420a45e4085932bdb9381af3cc4678bd962af616549e4020d2c9fd25e2117a6d8934fde2218273d7833d60ea492e251417a27e7fb32012a940a6b6487af4b64958bf05f1b1107732149d227eeda5ca5a43cf583dc297d66072a1acd75e93a7caefd36a0d581e21d5cb08654c4ecef46ebac5391546e0b7d2a6418548d8f816446bcf237f676e873e6bae9107234abe5ab24c53ea472ad10653cef068fd9f4e729fc0d526e489f8df13af5575f1e70e0ec22899728b0659d70fc2dd509d9df3ec170638f89e540f4d3f02aa9b1b1819f84da596e0d7b45a5818061728f8eeccd2bea0f460dd7e18cb95f2364c50e351f0690e184eb63ebbb14a0b4b2117e44f3b2b3", 0x2000, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a00)={0x130, 0x0, 0x400, {0x0, 0x10, 0x0, '\x00', {0x7ff, 0x7, 0x4, 0x2, r8, 0xffffffffffffffff, 0x1000, '\x00', 0x1, 0x80000002, 0xb4e7, 0x2, {0x80000008103, 0x8}, {0x8, 0x10001}, {0x100000000, 0x7}, {0x9, 0xa82}, 0x8000, 0xb, 0x4, 0x5}}}}) write$FUSE_INIT(r2, &(0x7f0000001200)={0x50, 0x0, r7}, 0x50) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) openat$sysfs(0xffffffffffffff9c, &(0x7f00000003c0)='/sys/kernel/vmcoreinfo', 0x800, 0x40) r11 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_FILTER(r11, 0x6b, 0x1, &(0x7f0000000280)=[{0x2, 0x2, {0x0, 0xc25ecb9d809030cb, 0x2}, {0x1}, 0x2}, {0x3, 0x2, {0x1, 0xf0, 0x1}, {0x1, 0x0, 0x1}, 0x0, 0x1}, {0x2, 0x2, {0x1, 0x0, 0x1}, {0x0, 0xff, 0x4}, 0x0, 0x1}, {0x1, 0x2, {0x0, 0x0, 0x3}, {0x1, 0x1}, 0x2}], 0x80) bind$can_j1939(r11, &(0x7f0000000080)={0x1d, r10}, 0x18) sendmsg$can_j1939(r11, &(0x7f00000001c0)={&(0x7f0000000040), 0x18, &(0x7f0000000180)={&(0x7f00000000c0)="92", 0x1a000}}, 0xee) sendmsg$nl_route_sched(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=@newtfilter={0x24, 0x11, 0x101, 0x70bd25, 0x100000, {0x0, 0x0, 0x74, r10, {0xa, 0x9}, {0xb, 0xfff3}, {0xffff, 0x6}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x40}, 0xc4) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x14, 0x1, 0x2, 0x3, 0x0, 0x0, {0xa, 0x0, 0x5}}, 0x14}}, 0x0) r12 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x26) ioctl$KVM_SET_USER_MEMORY_REGION(r12, 0x4020ae46, &(0x7f0000000000)={0x4, 0x0, 0x0, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="050000"], 0x48) 15m8.328188162s ago: executing program 3 (id=1552): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000200)) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x2, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f00000002c0)={[{0x2d, 'rlimit'}]}, 0x8) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) syz_clone3(&(0x7f0000000280)={0x2041080, 0x0, 0x0, 0x0, {0x33}, 0x0, 0x0, 0x0, 0x0}, 0x58) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r6 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000008, 0x10, r5, 0x10000000) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r4, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r6, &(0x7f0000000400)=@IORING_OP_MKDIRAT={0x25, 0x8, 0x0, r5, 0x0, &(0x7f00000000c0)='./file0/file0\x00', 0x102, 0x0, 0x1, {0x0, r7}}) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r9 = socket(0x10, 0x803, 0x0) bind$tipc(r9, &(0x7f0000000380)=@name={0x1e, 0x2, 0x0, {{0x43, 0x1}}}, 0x10) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) mknodat(r1, &(0x7f0000000340)='./file0\x00', 0x10, 0x6) sendmsg$qrtr(r9, &(0x7f00000007c0)={&(0x7f0000000440)={0x2a, 0x1, 0x4000}, 0xc, &(0x7f0000000700)=[{&(0x7f0000000480)="af8b427c3250a8ff6db68f980fd26dc911fde838e10b85ac466113d779870ee86543c6465d6f15bd156cf4cbdd56ca744f2fbc106ceab5a39184853838e6485cfae6ceed719a785ffffdeae3fefe5d52fe6a9b76bb152cffb11b8783591e0e7c86fee84baca1ee2cb659414de9803a2edbf297589c21a894295cfb5d098f27c4d6b5729eded27cd422439c21bcbdbf5ba6a484da6dd23e757762223894a3b45974e5f4e1bdd3747962069bb713ab21044800aab7d3c7e7bca253cee4861c828201f3b28d523739cf43763abbca7988c9b115b27c159936a56b3b2ffa23f500f39516e62599cc745a52109e", 0xeb}, {&(0x7f0000000600)="14aff435d5b78280de55aec2dd9d86322482ca1d7dc20572f9d581c9595fd3e4", 0x20}, {&(0x7f0000000680)="42336650434f0a7974b36f90989a13e01276962397d7b85903548755e60c0f561ffbaf9528540eca55f4b9ed1dfc483a931c0801df73ee19a61397185341160d0b190c30d83bd24a99b4e4f1b037c12fd95ea084db9519b6d28617452ea6d6a7", 0x60}], 0x3, &(0x7f0000000740)=[{0x60, 0x102, 0x8000, "27326b7c2f896559b777a65921b8709a408ec57852ea95d3c730b3cecf1466c2ca9beb79f7e4541dec5d0ca53902c17c5ceef04be36f025b2910375df84624e6c2df339a31e1f14c1c2187de11"}], 0x60, 0x80}, 0x38) r13 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000049c0)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0x2}, {}, {0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0xffffefff}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x4) move_mount(r8, &(0x7f00000001c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x51) 15m7.355493986s ago: executing program 3 (id=1554): sendmmsg$unix(0xffffffffffffffff, &(0x7f00000010c0)=[{{0x0, 0x0, &(0x7f0000000780), 0x0, &(0x7f0000001480)=ANY=[@ANYBLOB="1400001c00000000410000000a3a0e9b33ebcaa534a746f4451856c324cd3c399e241d1630a4f30490fb2f0000000000f855085023d8061322c6e6bd26f17dee28cff13beb07588996070000000000000062d97e6ec4ae53efea03dc89a2ff1a0c2977baaeb6ab36ad477c5e", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00'], 0x18, 0x20000080}}], 0x1, 0xc001) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d424000000000000002900000002000000", 0xfe60) 15m6.132460424s ago: executing program 3 (id=1560): r0 = syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 15m5.707486298s ago: executing program 32 (id=1560): r0 = syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) 56.191851421s ago: executing program 4 (id=4925): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000280)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000006, 0x46032, 0xffffffffffffffff, 0x0) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000bc0), 0x2, 0x0) fcntl$setstatus(r2, 0x4, 0x2800) r3 = syz_io_uring_setup(0x9e, &(0x7f0000000000)={0x0, 0xec25, 0x0, 0x2, 0x40000333}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) r6 = socket$rxrpc(0x21, 0x2, 0xa) r7 = syz_io_uring_setup(0x12ab, &(0x7f0000000140)={0x0, 0x7495, 0x0, 0x2, 0x1f7}, &(0x7f0000000380)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x80, &(0x7f00000000c0)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e24, @private=0xa010102}}, 0x0, 0x0, 0x1}) io_uring_enter(r7, 0x3516, 0x0, 0x0, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r11, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(r4, r5, 0x0) io_uring_enter(r3, 0x47ba, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 55.064388548s ago: executing program 4 (id=4927): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f0000000000)=0x7, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x2000c00) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000060a010400000000000000000a00fffd0900010073797a310000000018000480140001800d00010073796e70726f78790000000009000200010000000000001415000000000a"], 0x6c}, 0x1, 0x0, 0x0, 0x8800}, 0x24000000) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x0, 0x94e1, @local, 0x200, 0x1}, 0x20) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$bt_hci(r2, 0x0, 0x1, 0x0, &(0x7f0000000380)) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000080)=0x1f6, 0x4) sendmmsg$inet(r3, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = msgget$private(0x0, 0x3ac) msgrcv(r4, 0x0, 0x0, 0xe4b43f0e2aa28c96, 0x2000) msgrcv(r4, 0x0, 0x5e, 0xd2f79d26f0753ec2, 0x2000) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$FUSE_NOTIFY_DELETE(r5, &(0x7f0000001fc0)=ANY=[@ANYBLOB="4500000003"], 0x45) msgsnd(r4, &(0x7f0000000080)=ANY=[], 0x8, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x82, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002300), 0x2, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x208040, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000600)={0x4, 0xff7ffffffffffffd, 0x2, 0x6, 0xfffffffffffffffe, 0x9, 0x8000000000000000, 0x40000000008}, 0x0, &(0x7f0000000400)={0x7fc, 0x139b, 0x2b7, 0x80, 0xc, 0xc3ad, 0x0, 0xc2c8}, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) 53.879576888s ago: executing program 4 (id=4929): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) r2 = gettid() timer_create(0x0, &(0x7f0000000180)={0x0, 0x11, 0x4, @tid=r2}, &(0x7f0000000080)=0x0) read$FUSE(r1, &(0x7f0000004940)={0x2020}, 0x7dcbc21cf56a2dae) timer_create(0x1, &(0x7f0000000000)={0x0, 0x4, 0x2, @thr={&(0x7f0000000480)="e736b08574127ab0bcce96b3d987d024d797c92858a18c9ba72851785c08bb08ffb1a891e29b1b0b05a1d016eeb6454bac52f4113762625c5a148296925f2d996f63c08db4ae8a3d649fee09fc6e8aed9b393f52f9e225c7935f4bb2c047184b272352692b3014a6ff0eb84e216a45bd1645237bc3e0616750820d", &(0x7f0000000200)="79c3f60014870d7d98404378c4ddf56fc315cfcc3a84d63c1a9571dae1f181170dc86ee03e3e9bfa07eafe510c2b79367c67b14f083e4f68e28901f730"}}, &(0x7f0000000040)) timer_settime(r3, 0x1, &(0x7f00000000c0)={{0x77359400}, {0x77359400}}, 0x0) openat$rdma_cm(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x200000005c832, 0xffffffffffffffff, 0x0) r5 = io_uring_setup(0x3eae, &(0x7f0000000500)={0x0, 0x7302, 0x4, 0x2, 0x4000009}) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0x9, &(0x7f0000000100)=0x207, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) sendmsg$inet(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000240)='`/3', 0x3}], 0x1}, 0x4040044) sendto$packet(r6, &(0x7f00000002c0)="05031600d3fc140000004788031c09103c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)=ANY=[@ANYBLOB="48000000020601000000000600000000000000000e0003006269746d61703a6970000000050004002000000009000200736763300000000005000500020000000500010006000000"], 0x48}}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80202, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, 0x0, 0x0) 53.782225161s ago: executing program 4 (id=4930): mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x20, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r3 = gettid() r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r4, &(0x7f0000000200)=""/209, 0xd1) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r4, 0x4040534e, &(0x7f0000000080)={0x335}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r4, 0xc0a85352, &(0x7f0000000f00)={{0x2, 0x5}, 'port1\x00', 0x84, 0x1028, 0x1, 0xb, 0xfbe, 0x0, 0x9, 0x0, 0x7, 0x2}) tkill(r3, 0x7) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x4058534c, &(0x7f0000000200)={0x3, 0xfffffffa, 0x9, 0x1, 0x2, 0x10000}) r5 = syz_open_dev$loop(&(0x7f0000000000), 0x9, 0x2641) ioctl$LOOP_SET_FD(r5, 0x4c00, r2) dup2(r2, r0) 53.340792866s ago: executing program 4 (id=4931): r0 = socket(0x1, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './mnt\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) fcntl$getown(r3, 0x9) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) shutdown(r4, 0x1) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000000100)={0x0, 0x3f7, 0x3, 0x0, 0x2, 0x7fff, 0x1, 0x7, {0x0, @in={{0x2, 0x4e23, @multicast2}}, 0x4, 0x7, 0x6, 0x1, 0x9}}, &(0x7f0000000040)=0xb0) r5 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a01010000000000000000027eedb7a7f9f97c0000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000020a0500000000000000000000000000140000001100010000000000000000000000000a"], 0x9c}}, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x1000000008, 0x10000, 0x3}, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @value=0x3}) add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) r7 = getpgid(0x0) kcmp(r7, 0x0, 0x6, 0xffffffffffffffff, 0xffffffffffffffff) r8 = syz_open_dev$dri(0x0, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)=@newtaction={0x48, 0x76, 0x1, 0xfffffffc, 0x0, {}, [{0x34, 0x1, [@m_vlan={0x30, 0xd, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040081}, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r8, 0xc018643a, 0x0) syz_io_uring_setup(0x304, 0x0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'veth1_to_hsr\x00', &(0x7f0000000240)=@ethtool_stats={0x1d, 0x4, [0x6, 0x7fff, 0x5, 0x6]}}) 53.223745973s ago: executing program 4 (id=4932): r0 = socket$kcm(0x2, 0x0, 0x2) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0xfd05, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB=',\x00\x00\x00\x00D\x00'/17], 0x30}, 0x0) 53.081782899s ago: executing program 33 (id=4932): r0 = socket$kcm(0x2, 0x0, 0x2) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0xfd05, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB=',\x00\x00\x00\x00D\x00'/17], 0x30}, 0x0) 10.494106938s ago: executing program 2 (id=5069): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f0000000080)=0x81) (async) ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000340)=0x9) (async) r1 = openat$binfmt_register(0xffffff9c, &(0x7f0000000040), 0x1, 0x0) writev(r1, &(0x7f0000001f00)=[{&(0x7f0000001ac0)="4df069d64970996b9472d4", 0xb}], 0x1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x12, &(0x7f00000000c0)=0x10001, 0x4) (async) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) (async) recvmmsg(r2, &(0x7f0000003f80)=[{{&(0x7f0000000400)=@ax25={{0x3, @default}, [@default, @netrom, @remote, @default, @remote, @remote, @netrom, @default]}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000740)=""/4096, 0x1000}], 0x1, &(0x7f0000001f40)=""/4096, 0x1000}, 0x3}, {{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000480)=""/255, 0xff}, {&(0x7f0000000580)=""/8, 0x8}, {&(0x7f0000002f40)=""/4096, 0x1000}, {&(0x7f00000005c0)=""/72, 0x48}], 0x4, &(0x7f0000000680)=""/89, 0x59}, 0x1ff}, {{0x0, 0x0, &(0x7f0000001a00)=[{&(0x7f0000001740)=""/220, 0xdc}, {&(0x7f0000001840)=""/172, 0xac}, {&(0x7f0000001900)=""/210, 0xd2}], 0x3, &(0x7f0000001a40)=""/96, 0x60}, 0x7}, {{&(0x7f0000001b00)=@caif=@rfm, 0x80, &(0x7f0000001c80)=[{&(0x7f0000001b80)=""/166, 0xa6}, {&(0x7f0000001c40)=""/16, 0x10}], 0x2, &(0x7f0000001cc0)=""/206, 0xce}, 0x4}, {{0x0, 0x0, &(0x7f0000001ec0)=[{&(0x7f0000001dc0)=""/244, 0xf4}], 0x1, &(0x7f0000003f40)=""/64, 0x40}, 0x3}], 0x5, 0x23, &(0x7f00000040c0)) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@mss, @timestamp, @timestamp, @window={0x3, 0x4, 0xfff8}, @window, @window], 0x6) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000700), 0x4) (async) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)={0x38, 0x140d, 0x800, 0x70bd2d, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x84}, 0x4018) (async, rerun: 32) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async, rerun: 32) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0xa01) ioctl$EVIOCGBITKEY(r4, 0x80404521, &(0x7f0000000040)=""/192) (async, rerun: 64) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bond\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELFLOWTABLE={0x98, 0x16, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x6c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'pim6reg1\x00'}, {0x14, 0x1, 'veth1_to_bond\x00'}, {0x14, 0x1, 'veth1_vlan\x00'}, {0x14, 0x1, 'veth0_vlan\x00'}]}]}]}], {0x14, 0x10}}, 0x138}}, 0x0) (async, rerun: 64) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) (async, rerun: 64) setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f0000000040)=@req={0xb, 0xb, 0x6, 0xbe}, 0x10) (rerun: 64) sendto$inet(r2, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) (async) recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25) 10.394398986s ago: executing program 0 (id=5070): llistxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)=""/191, 0xbf) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f00000005c0)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x47b07c7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x4f0e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) r1 = dup(r0) ioctl$UI_DEV_CREATE(r1, 0x5501) io_setup(0x490, &(0x7f0000000000)=0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x8, 0xffffffffffffffff, 0x0, 0x0, 0x9, 0x0, 0x1}]) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f00000000c0)=@req={0x8000, 0xb4f, 0x300, 0x1daf6}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x31, &(0x7f0000000000)=0x8, 0x4) write$uinput_user_dev(r1, &(0x7f00000000c0)={'syz0\x00', {0xfff7, 0xc, 0x100, 0xcb}, 0x1d, [0x7b, 0xb7e2, 0x3, 0x9, 0x100, 0x3, 0x1, 0x7, 0x9, 0x2, 0x7, 0xa, 0x3, 0x0, 0x7f, 0xd, 0x7fff, 0x6, 0x6, 0x45, 0x6, 0x6, 0x7, 0x6, 0xff, 0x2, 0xfffff5ee, 0x401, 0x0, 0xfc75, 0x8, 0x9, 0x4, 0x2, 0xffffffff, 0x81, 0xfffff765, 0x2, 0x3, 0xfffffff9, 0xa, 0x2, 0x5, 0x0, 0xfffffff7, 0x6, 0x7, 0x4c, 0x1, 0x80, 0x8, 0xa, 0x9, 0x7, 0x8000101, 0xc3c, 0x1733, 0x7fff, 0x7ffc, 0x1, 0x6, 0x5, 0x1, 0x4], [0x10, 0x3, 0x8, 0x8, 0x0, 0x8, 0x4, 0x0, 0x25, 0x10, 0x6, 0x7, 0x8, 0xe62, 0xffffff73, 0x1000, 0x6, 0x13e5, 0x3, 0x3, 0x1000, 0x7, 0x1, 0x3b40, 0x4, 0x1000, 0x5, 0x7fff, 0x8, 0x5a, 0xffff2503, 0x7fffffff, 0x6995, 0x1, 0x80000000, 0x8, 0xdaa, 0x5, 0x2, 0x76c4, 0xfffffffd, 0x5, 0x4, 0x10000, 0xd, 0x2, 0x9, 0x10, 0x4000e, 0x9, 0x7, 0xa, 0x9, 0x3, 0x8, 0x3, 0x6, 0x3a6, 0x27f8, 0xc0d, 0xfffffffd, 0x9, 0xc, 0xfffffffb], [0xa3, 0x6, 0x6, 0x9, 0x1000, 0x0, 0x80000000, 0x5, 0x7f, 0xa, 0x100, 0x1000, 0xf1, 0x6, 0xc, 0x10000, 0x72, 0xefa, 0x633, 0xd, 0x7, 0x6, 0x80000000, 0x6, 0x0, 0x7, 0x8, 0x2ef3adcb, 0x10, 0x2, 0x8, 0x8, 0x74, 0x4, 0x7, 0x801, 0xfffffff2, 0x63, 0x7, 0x2, 0x3, 0x3, 0x20a7fd9e, 0xfffffffd, 0x2, 0xa1, 0x0, 0x9d, 0x7, 0xa8a, 0x2, 0x6, 0x77, 0x8, 0x1ff, 0x7, 0x7, 0x2, 0x8, 0x2, 0x8, 0x2, 0x3, 0x5], [0x4, 0x4, 0x5, 0x8000, 0x493e, 0x3, 0x35ff4447, 0x7, 0x5, 0x4, 0x7fff, 0x5, 0x5, 0x3ff, 0xb88f, 0xffff0000, 0x9, 0xf7df, 0x2, 0x10, 0x8, 0x2, 0xff, 0x6, 0x5, 0x2, 0x3, 0x0, 0x7, 0x4e6, 0x8, 0x6, 0x5ef, 0x8000, 0xc, 0x4, 0x401, 0x1, 0x5, 0x0, 0x9a8, 0xe32, 0x231, 0x3ff, 0x8, 0x1, 0xffff0001, 0x1, 0x1, 0x10, 0x8, 0x5396, 0x6161, 0x9, 0x101, 0x1ff, 0x8, 0x431, 0x6, 0x5, 0x4, 0x7b, 0x7fc, 0x9]}, 0x45c) r3 = syz_io_uring_setup(0x9e, &(0x7f0000001280)={0x0, 0x936, 0x0, 0x0, 0x1f3}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000240)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x47b6, 0x800000, 0x0, 0x0, 0x0) 10.217543545s ago: executing program 0 (id=5072): syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x101840) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000080)={0xa, 0x0, 0x1, {0xe7ff, 0x1, 0x406, 0x870}}) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) migrate_pages(0x0, 0x5, &(0x7f0000000000)=0x9, 0x0) r3 = socket(0xa, 0x3, 0x3a) syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @remote}, {0xa, 0x4e22, 0xfffffffd, @mcast1}}, 0x5c) setsockopt$MRT6_ADD_MFC(r3, 0x29, 0xcc, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/address_bits', 0x10200, 0x1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r5, 0x0, 0x4000000) sendmsg$NFT_BATCH(r4, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x4008000) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r6 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) 10.108021875s ago: executing program 2 (id=5073): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) getpeername(r0, &(0x7f0000000140)=@ethernet={0x0, @remote}, &(0x7f0000000000)=0x80) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r5, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xed43, 0xf8, 0x6, 0x9, 0x151}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x50}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000300)=ANY=[@ANYBLOB="34000000190001000000000000000000802000000011fe0500"], 0x34}}, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$inet_mptcp(0x2, 0x1, 0x106) syz_usb_connect$uac1(0x0, 0x71, &(0x7f00000007c0)=ANY=[@ANYBLOB="12015002000000106b1d010140000102030109025f0003010600020904000004010100000a2401ff07010201020904010000010200000904010101010200000905010940000a2a0f07250180090001090402000021020000090402010101020000090582090004b3030007250158fbdb87a69aedb302040104723f2c0648cb1fadeac603553d89bc6d8c39be19c3fc973c002f557937011631fc90711393ca10ccc753e4dfd7641303e238e2d917411eb4ecf60c4e34466d18804fc391dc847766bdca45d16bb357a04b4b4a1279c11acdd3ef5e0b1e8c9ba08e8d0fbb3cd3aad77ee19826f852040cb181d35e55af8f9ef242f72bf82e4f35265ee99c3d606e498b69f13a7a10722237366a8cf9e6b3760e4a764d040e8d8c846c82028640b820bf4160bd7805bf702fce959141ac8d8457ca3114416b76176a9812f74e7cefe331b31587d0e18b4113591ff733f6a62a306d3117db6087e9212b88e9ccaa014e6853aa68d7161ce90e214b984149fc0fe05870876b12eea88cb91f1e645cc42de3c4"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x3}, 0x50) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01000000000000000000100000000c00018008000100", @ANYRES32=r10, @ANYBLOB="080011"], 0x28}, 0x1, 0x0, 0x0, 0x40000c5}, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) socket(0x2a, 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000000c0), 0x8) 6.466853574s ago: executing program 6 (id=5082): llistxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)=""/191, 0xbf) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f00000005c0)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x47b07c7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x4f0e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) r1 = dup(r0) ioctl$UI_DEV_CREATE(r1, 0x5501) io_setup(0x490, &(0x7f0000000000)=0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x8, 0xffffffffffffffff, 0x0, 0x0, 0x9, 0x0, 0x1}]) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f00000000c0)=@req={0x8000, 0xb4f, 0x300, 0x1daf6}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x31, &(0x7f0000000000)=0x8, 0x4) write$uinput_user_dev(r1, &(0x7f00000000c0)={'syz0\x00', {0xfff7, 0xc, 0x100, 0xcb}, 0x1d, [0x7b, 0xb7e2, 0x3, 0x9, 0x100, 0x3, 0x1, 0x7, 0x9, 0x2, 0x7, 0xa, 0x3, 0x0, 0x7f, 0xd, 0x7fff, 0x6, 0x6, 0x45, 0x6, 0x6, 0x7, 0x6, 0xff, 0x2, 0xfffff5ee, 0x401, 0x0, 0xfc75, 0x8, 0x9, 0x4, 0x2, 0xffffffff, 0x81, 0xfffff765, 0x2, 0x3, 0xfffffff9, 0xa, 0x2, 0x5, 0x0, 0xfffffff7, 0x6, 0x7, 0x4c, 0x1, 0x80, 0x8, 0xa, 0x9, 0x7, 0x8000101, 0xc3c, 0x1733, 0x7fff, 0x7ffc, 0x1, 0x6, 0x5, 0x1, 0x4], [0x10, 0x3, 0x8, 0x8, 0x0, 0x8, 0x4, 0x0, 0x25, 0x10, 0x6, 0x7, 0x8, 0xe62, 0xffffff73, 0x1000, 0x6, 0x13e5, 0x3, 0x3, 0x1000, 0x7, 0x1, 0x3b40, 0x4, 0x1000, 0x5, 0x7fff, 0x8, 0x5a, 0xffff2503, 0x7fffffff, 0x6995, 0x1, 0x80000000, 0x8, 0xdaa, 0x5, 0x2, 0x76c4, 0xfffffffd, 0x5, 0x4, 0x10000, 0xd, 0x2, 0x9, 0x10, 0x4000e, 0x9, 0x7, 0xa, 0x9, 0x3, 0x8, 0x3, 0x6, 0x3a6, 0x27f8, 0xc0d, 0xfffffffd, 0x9, 0xc, 0xfffffffb], [0xa3, 0x6, 0x6, 0x9, 0x1000, 0x0, 0x80000000, 0x5, 0x7f, 0xa, 0x100, 0x1000, 0xf1, 0x6, 0xc, 0x10000, 0x72, 0xefa, 0x633, 0xd, 0x7, 0x6, 0x80000000, 0x6, 0x0, 0x7, 0x8, 0x2ef3adcb, 0x10, 0x2, 0x8, 0x8, 0x74, 0x4, 0x7, 0x801, 0xfffffff2, 0x63, 0x7, 0x2, 0x3, 0x3, 0x20a7fd9e, 0xfffffffd, 0x2, 0xa1, 0x0, 0x9d, 0x7, 0xa8a, 0x2, 0x6, 0x77, 0x8, 0x1ff, 0x7, 0x7, 0x2, 0x8, 0x2, 0x8, 0x2, 0x3, 0x5], [0x4, 0x4, 0x5, 0x8000, 0x493e, 0x3, 0x35ff4447, 0x7, 0x5, 0x4, 0x7fff, 0x5, 0x5, 0x3ff, 0xb88f, 0xffff0000, 0x9, 0xf7df, 0x2, 0x10, 0x8, 0x2, 0xff, 0x6, 0x5, 0x2, 0x3, 0x0, 0x7, 0x4e6, 0x8, 0x6, 0x5ef, 0x8000, 0xc, 0x4, 0x401, 0x1, 0x5, 0x0, 0x9a8, 0xe32, 0x231, 0x3ff, 0x8, 0x1, 0xffff0001, 0x1, 0x1, 0x10, 0x8, 0x5396, 0x6161, 0x9, 0x101, 0x1ff, 0x8, 0x431, 0x6, 0x5, 0x4, 0x7b, 0x7fc, 0x9]}, 0x45c) r3 = syz_io_uring_setup(0x9e, &(0x7f0000001280)={0x0, 0x936, 0x0, 0x0, 0x1f3}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000240)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x47b6, 0x800000, 0x0, 0x0, 0x0) 6.280959085s ago: executing program 6 (id=5083): r0 = socket(0x80000000000000a, 0x2, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, 0x0, &(0x7f00000000c0)) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, &(0x7f0000000100)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000300)={@local, @link_local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x21, 0x0, @private, @broadcast}, @redirect={0x5, 0x0, 0x0, @private=0xa010102, {0xa, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x1}, {[@rr={0x7, 0x13, 0x0, [@multicast2, @private, @broadcast, @dev={0xac, 0x14, 0x14, 0xc}]}]}}}}}}}, 0x0) r5 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}}, 0x1c) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) syz_usb_connect(0x2, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100002c23b740c71b4010b1b501020301090224000100000000090400000212c7"], 0x0) 6.123575672s ago: executing program 2 (id=5084): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x88a8, &(0x7f0000000000)={&(0x7f0000000480)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8080, 0x8400}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_OKEY={0x8}]}}}]}, 0x40}}, 0x0) 5.971640948s ago: executing program 2 (id=5085): r0 = socket(0x2b, 0x1, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000580)=0xe) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000080)=0x7f) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) socket$l2tp(0x2, 0x2, 0x73) r3 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) ioctl$VIDIOC_G_SELECTION(r7, 0xc040565e, &(0x7f00000003c0)={0xa, 0x0, 0x0, {0x80000004, 0x1, 0x2, 0x8800001}}) sendto$inet6(r6, &(0x7f0000000180)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e", 0x87, 0x0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f00000000c0)=0x6) dup3(r2, r3, 0x80000) capget(&(0x7f0000000140)={0x20080522, 0xffffffffffffffff}, &(0x7f0000000180)={0x7, 0x8, 0x6, 0x8, 0x1, 0xffffffff}) read$dsp(r1, &(0x7f00000011c0)=""/4117, 0x200021d5) r8 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r8, &(0x7f0000002a40)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_SWAP(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000060601"], 0x14}}, 0x810) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) 5.952380372s ago: executing program 0 (id=5086): r0 = socket(0x2b, 0x1, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000580)=0xe) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000080)=0x7f) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) socket$l2tp(0x2, 0x2, 0x73) r3 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) ioctl$VIDIOC_G_SELECTION(r7, 0xc040565e, &(0x7f00000003c0)={0xa, 0x0, 0x0, {0x80000004, 0x1, 0x2, 0x8800001}}) sendto$inet6(r6, &(0x7f0000000180)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e", 0x87, 0x0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f00000000c0)=0x6) dup3(r2, r3, 0x80000) capget(&(0x7f0000000140)={0x20080522, 0xffffffffffffffff}, &(0x7f0000000180)={0x7, 0x8, 0x6, 0x8, 0x1, 0xffffffff}) read$dsp(r1, &(0x7f00000011c0)=""/4117, 0x200021d5) r8 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r8, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={0x0, 0x14}}, 0x0) sendmsg$IPSET_CMD_SWAP(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000060601"], 0x14}}, 0x810) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) 5.571085537s ago: executing program 5 (id=5087): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0), 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) io_setup(0x20, &(0x7f0000001140)=0x0) io_submit(r6, 0x1, &(0x7f00000001c0)=[&(0x7f0000002040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r5, &(0x7f0000000080)="0d32818e7e6ae0", 0x7}]) 5.229292221s ago: executing program 1 (id=5088): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_open_dev$sg(&(0x7f0000000280), 0x5dc, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x80800, 0x0, 0xffffffffffffffff}) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000140)={&(0x7f00000006c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000003c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000140)={&(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000300)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0], 0x8, 0x7, 0x6}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000580)={&(0x7f00000001c0)=[0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000540)=[0x0, 0x0, 0x0, 0x0], 0x1, 0xa, 0x4, 0x4}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(0xffffffffffffffff, 0xc05064a7, &(0x7f0000000880)={&(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000680)=[{}, {}, {}, {}], &(0x7f00000007c0)=[0x0, 0x0, 0x0], &(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x4, 0x3, 0x6}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000980)={&(0x7f0000000900)=[0x0], &(0x7f0000000940)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x1, 0x0, 0xb0b0b0b0}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000c80)={&(0x7f00000009c0)=[0x0], &(0x7f0000000a00)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f0000000c00)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000c40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x5, 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000dc0)={0x0, 0x3, &(0x7f00000005c0)=[r3, r4, r5], &(0x7f0000000600)=[0x6, 0xee71, 0xfffffffd], &(0x7f0000000d00)=[r6, r7, r8], &(0x7f0000000d40)=[0x8000000000000000, 0x4, 0x4, 0x6f, 0x7f, 0x4, 0x0, 0x8165, 0x40], 0x0, 0x7f}) syz_emit_ethernet(0x46, &(0x7f0000000280)={@broadcast, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, "0400d8", 0x10, 0x3a, 0xff, @local, @mcast2, {[], @ni={0xd191bfdeb5199e1, 0x0, 0x0, 0x3, 0xffff, 0x7fffffffffffffff}}}}}}, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000002c0)={0x0, 0xe, 0xa3}) 5.083758904s ago: executing program 1 (id=5089): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000010d804dd000000000000010902240001000000e9090400000103000000092105000001220500090581030002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000280)="1000a8631eabc817ff") sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)=ANY=[@ANYBLOB="1400000010000100006c8c993f0000000500000a28000000090a010400000000000000000a0000040900010073797a310000000008000540257f28264245aca0ab51a25be2140000001115010000000000000000000100000aedcf"], 0x50}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) clock_adjtime(0x0, &(0x7f0000000000)={0xfffd, 0x4, 0xb0000000000, 0x3, 0x0, 0x0, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x3b9ac9ff, 0x0, 0x81, 0xffffffffffffffff, 0x2000000000000000, 0x5a6c101, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x1ff, 0x4}) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYRESDEC=r0], 0xb8}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x188}}, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r3, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000300)=r2}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000100)={r4}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r5 = getpid() sched_setscheduler(r5, 0x0, &(0x7f0000000200)=0xfffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x2, &(0x7f0000000140)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES64, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip6_mr_cache\x00') read$FUSE(r6, &(0x7f0000000e80)={0x2020}, 0x2020) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000280)={'ip6_vti0\x00', &(0x7f0000000200)={'ip6_vti0\x00', 0x0, 0x29, 0xc, 0x9, 0x0, 0x8, @remote, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8000, 0x700, 0x10001, 0x6}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=@getqdisc={0x48, 0x26, 0x2, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0xfff3, 0xb}, {0x0, 0xb}, {0xa, 0x8}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x48}}, 0x0) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)={0x78, 0x7, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x54, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_META_SREG={0x8}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x17}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x23}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x18}, @NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x11}]}}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x80}, 0x44000) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r8) sendmsg$ETHTOOL_MSG_DEBUG_SET(r8, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x2) connect$unix(0xffffffffffffffff, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) 4.552348264s ago: executing program 5 (id=5090): r0 = syz_open_dev$dri(&(0x7f0000000280), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x401064d0, &(0x7f0000000000)={0x5, 0x2}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x40000000000009, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff}) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, 0x0, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) listen(r4, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="24000000020103000000000000000000000000010c00198008000100c27a"], 0x24}, 0x1, 0x0, 0x0, 0x41}, 0x4000004) r6 = socket$vsock_stream(0x28, 0x1, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000001380), 0x0) connect$vsock_stream(r6, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f0000000240)={0x0, 0x5, 0x0, &(0x7f0000000100)={0xe, "c656cd6b35395c5e563042b7c720df152bfdbc6f86dcf206b373451afcb0dd6aa2"}}) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000000040)=0x0) timer_settime(r8, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r9 = dup(r6) write$6lowpan_enable(r9, &(0x7f0000000000)='0', 0xfffffd2c) getpeername$packet(r9, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@ipv4_delroute={0x40, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, 0x0, 0x0, 0xff, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_ENCAP={0xc, 0x16, 0x0, 0x1, @ILA_ATTR_HOOK_TYPE={0x1f, 0x9, 0x1}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x6}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$inet6(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000340)="781b1b8db5ef30ce7ed14d1d3af4721f4b6ed78570b97412d1e58e195e200603d557df1c3495920833c17b12cc9f391bb01f8f57e79035fbdb9f7fb2", 0x3c}], 0x1, &(0x7f0000000680)=[@rthdr={{0x88, 0x29, 0x39, {0x1, 0xe, 0x0, 0x81, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x20}, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, @private2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty]}}}, @rthdrdstopts={{0xc0, 0x29, 0x37, {0x18, 0x14, '\x00', [@generic={0x2, 0x32, "19a3a7e97eeeeccfbc75ac16f5f54bf3b08d7302d03c5797a660898ff27082465d86e403acf4b5c6998a6133fc7ecd5629d1"}, @enc_lim={0x4, 0x1, 0x5}, @padn={0x1, 0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x30, {0x3, 0xa, 0x5, 0xf, [0x80000000, 0x0, 0x7, 0x79, 0x0]}}, @hao={0xc9, 0x10, @private1={0xfc, 0x1, '\x00', 0x1}}, @enc_lim={0x4, 0x1, 0x9a}, @padn={0x1, 0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @remote}]}}}, @rthdrdstopts={{0x158, 0x29, 0x37, {0xc, 0x27, '\x00', [@pad1, @generic={0x3, 0xfc, "0ca4d45ac81885b71b8f7f1bf05d94f9eb7952d35bcc60fbf6371b6e4e933a2ec3481966bbe14717852f18578763307fa4c3964f5c56a7fe91256d472a9c833fa9b6afe601100520ba202dc52681e158d8ff7880c12011c8f70cc9edba2dbd492306002fd8e4848324ff5938904fe1966a371ad590e07a97c2cceec65f62a7a629d16cbff52c22e5603ef2db1bf856d558e6e2585cba3db262c151019013b5fd0b12b7155effc54a9d719d647e373d2c0320a473f6f19f4edb87eb7c9bd7f027cac044725e0dd5d0e503528fe6095f5484e0560cc6cec57065b8246268247442ace0d2ea784dbd2c2bac112cc3546d9de59ffc5cfd72657232c4ee6c"}, @ra={0x5, 0x2, 0x3}, @calipso={0x7, 0x8, {0x2, 0x0, 0x80, 0x7f}}, @hao={0xc9, 0x10, @private2={0xfc, 0x2, '\x00', 0xf7}}, @pad1, @pad1, @hao={0xc9, 0x10, @ipv4={'\x00', '\xff\xff', @remote}}]}}}, @rthdr={{0x98, 0x29, 0x39, {0x0, 0x10, 0x0, 0x5, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00', @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2, @private0, @empty, @empty]}}}, @rthdr={{0x28, 0x29, 0x39, {0x29, 0x2, 0x2, 0x11, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}]}}}], 0x360}, 0x20000000) write$P9_RSTATFS(r9, &(0x7f00000001c0)={0x43, 0x9, 0x1, {0x4b0, 0xa3, 0x4, 0x8000000000000001, 0xb6, 0x0, 0x1, 0x401, 0x7fff}}, 0x43) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) 3.487014095s ago: executing program 2 (id=5091): syz_io_uring_setup(0x1238, &(0x7f0000000380)={0x0, 0x80fd, 0x80, 0x2, 0xab9}, 0x0, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="180000001114fdffffff00000000000008004b"], 0x18}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r1, &(0x7f0000003240)=[{{&(0x7f0000000180)={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, '\x00', 0xd}, 0x4}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000100)="9e", 0x1}], 0x1}}], 0x1, 0x881) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000340)={r3, 0x3}, 0x8) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x74, &(0x7f0000000080)=""/135, &(0x7f0000000000)=0x87) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) r4 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100000b10b5103a09222689b7010203010902450001000000000904"], 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) 3.268316141s ago: executing program 0 (id=5092): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1221}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_TTL={0x5, 0x4, 0x5f}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @local}]}}}]}, 0x40}}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=@newsa={0xf0, 0x10, 0x1, 0x8000000, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {@in=@broadcast, 0x0, 0x33}, @in=@local, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x5680000000}, {0x10, 0x9}, 0x0, 0x0, 0x2, 0x1}}, 0xf0}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000600)=ANY=[@ANYBLOB="38000000180001bd000000000000000002000000fc00bd0900000000060015000200000014001680100008800c000280080001"], 0x38}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffebe}, 0x90) r2 = syz_io_uring_setup(0x24fa, &(0x7f0000000b80)={0x0, 0x1, 0x10100, 0x10, 0x4033a}, &(0x7f0000000300)=0x0, &(0x7f00000004c0)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='8'], 0x38}}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r2, 0x2d3e, 0x0, 0x40, 0x0, 0x0) 3.177405204s ago: executing program 6 (id=5093): sendmmsg$unix(0xffffffffffffffff, &(0x7f00000010c0)=[{{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000100)=' ', 0x1}], 0x1, 0x0, 0x18, 0x20000080}}], 0x1, 0xc001) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa8080000ffff000000000000210d0000aaa8fa017242ba9380d424000000000000002900000002000000", 0xfe60) 3.091935287s ago: executing program 0 (id=5094): socket$rds(0x15, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x6) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa05, &(0x7f0000000180)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00003ab000/0x2000)=nil, 0x400000, 0x2, 0x2}) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000100)=0x8, 0x4) sendmmsg$inet6(r0, &(0x7f0000000400)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x800, @loopback}, 0x1c, 0x0}}], 0x1, 0x60040000) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f0000000900)={0x44, &(0x7f0000000440)=ANY=[@ANYBLOB="000f7fcfebcf14c2aea512b9ee906de0ae0fbabc7b5606c2abb096d165c56dd909a8678b8eb172f38c6173c12915aa4007ebe49d4fd180fc80098d64a145ddcebad524a093f478ecd5ca887be884eed7e6dfd37f2b820c4d23153cb37d8646d5b423429298523b3df5304944c5fc06acf5d06837f51d5fe651942c539fe5aac81b0880a1d01daee61847749c1b897b1af8937e7c76ef7f412bcaf82cc90aa58fa5be13b6f3c55a00bfba64b0417fabb2c13486f77f3041d536b1cb493733abee6ddc5d2ce019e423738d51837cd1000c03fb6f776f19d8108f4dc01a0540b0e30a4ecf6b5daa093de236fbd1dd8e259c0af4d617c31b2dc457015360bec8cf0850f0c179727550b9ca321c92d59785934dee01009651130b788bb6c9f983962204e4d2dd51db6c705b09f2655c768e728de708277a9ba5d08f618d3e27b003e02ccd290bdccda967b0e74f54365dd1b329984f752c2a8e110dac16a8de84a810d3e394816479cc3759101da1089145700000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r2, 0x0, 0x0) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f80)=""/129, 0xfffffffffffffd40}, 0x7ffd}], 0x1, 0x40002042, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) ptrace$ARCH_MAP_VDSO_32(0x1e, r3, 0x13e9, 0x2002) rseq(0x0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r4, 0x8982, &(0x7f00000006c0)={0x0, 'bridge0\x00', {0x4}, 0x2}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=ANY=[@ANYBLOB="300000c000000108000080000000000100008000", @ANYRES16=r1, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x54, 0x10, 0x20, 0x70bd28, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0x7}}, [@TCA_RATE={0x6, 0x5, {0xfc}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x3, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x400c800}, 0x0) 3.075417538s ago: executing program 6 (id=5095): recvmmsg(0xffffffffffffffff, &(0x7f0000000cc0), 0x0, 0x40002102, 0x0) r0 = semget(0x2, 0x4, 0x200) semop(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) close(0x3) close(0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="05000000e6ef1f00060000007f00000001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000005c0)={0x0, 0x0, 0x0, &(0x7f0000000500), 0xf79, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x15, &(0x7f0000000580)={r2, &(0x7f0000001600), 0x0}, 0x20) r3 = socket$inet6(0xa, 0x3, 0x8000000003c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) connect$inet6(r3, 0x0, 0x0) sendmsg(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x4) sendmsg$NL80211_CMD_DEL_TX_TS(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000128bd7000ffdbdf256a00000008000300", @ANYRES32=0x0, @ANYBLOB="0500e700060000000802110000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) 2.966467638s ago: executing program 6 (id=5096): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000100), 0x9, 0x41) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000000)='-', 0x1) splice(r2, 0x0, r1, 0x0, 0x5, 0x4) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e80)=ANY=[@ANYBLOB="cb16000210010000b70700000100f0ff5070000000000000480000000820000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd364158a4591c559f76c0130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce74c4dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f00c484d339c480f70006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08ef74c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d3287a7b01ab84d336f3c0f45a0642d6f2c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcffff3ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d253e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd3153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00f80b58fd76e4bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be15579518540000bc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e99948a9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d14310700cf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c425190a6e3f1a8a3abfe6059da9c952cf35c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676080000007229e0237c1e34641848531712ff09e89fb062a3e66f4f3c9d7a7fc9aab1ced0ae679733830039cb61ea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfd0e5e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000000425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a690bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b270a3646ef55b9f070ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f000000000000000000000000bdcf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cdcc1f594ecfaff9a79b56f8b380380020000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x57, 0x10, &(0x7f0000000000), 0xffffffffffffffc9}, 0x48) vmsplice(r5, &(0x7f0000003680)=[{&(0x7f0000001400)="ebcb", 0x2}], 0x1, 0xe) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000040)="08167241b8", 0x5}], 0x1, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000002100), 0x9, &(0x7f0000000140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r6, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_CTX_GET_CPT_STATE(r6, 0x7b1, &(0x7f0000000100)={0x0, 0x6, 0x0, 0x9}) mount$fuseblk(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x2810e9, 0x0) 2.8038447s ago: executing program 6 (id=5097): execveat$binfmt(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = memfd_create(&(0x7f0000000780)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\nh<\x99\xaa\xe1\xf3\xb8Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev<\x97\x1a2_\x82\xfa\x15h$\x01\xdd\xe5\xceC\x19\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xb2\xf5\x1e5.\xc1\xa1\x05\x92\x82d\x0e\xf5PMjIt\xc5u~Tw\xbeNg\xb5\xeeP\x9c\xce\xfaS\xa7\xec0\xf4\xd2\xc2+@\x12=\xaa\b\xd2&\x19k6\xc7\xa6+\x04V\xc3\xe1\xd3\fZZ\x1cJo\xa5(& \r\xf1\xa4\xb8\xc23\x16\xc3\xaejA/', 0x0) write$binfmt_elf32(r3, &(0x7f0000000f00)=ANY=[], 0x66) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r4, 0x4601, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x1}, 0x0) r5 = fcntl$getown(r0, 0x9) getpriority(0x0, r5) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00'], 0x38}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f0000000240)={&(0x7f0000000180), 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x4) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x20000000000002b4, 0x0, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x45, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffff56, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$pppl2tp(0x18, 0x1, 0x1) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, &(0x7f0000000c00)={0x0, 0x0, 0x0}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/block/loop14', 0x210000, 0x1) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r8, r8, 0x0, 0x200000) syz_usb_connect(0x0, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) 2.747607177s ago: executing program 1 (id=5098): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000004580)={0x1, 0x5, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@cb_func={0x18, 0x8, 0x4, 0x0, 0x6}]}, &(0x7f0000000040)='syzkaller\x00', 0x6, 0x29, &(0x7f0000000200)=""/41, 0x40f00, 0xa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x36) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000400)=@ethtool_wolinfo={0x5, 0x0, 0x1580, "f9090800"}}) getsockopt$inet_udp_int(r2, 0x11, 0x65, &(0x7f00000001c0), &(0x7f0000000340)=0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_proto_private(r3, 0x8927, &(0x7f0000000100)="b468153a") r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0xffffffffffffffff, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0xffffffffffffffff, 0x2000000000000000, 0x80000004000000, 0x8d], 0xeeee8000, 0x2010d3}) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000100)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x30, 0x0, @ib={0x1b, 0x2, 0x5, {"135618b756551b775c720b2f17f7191e"}, 0x1, 0xdf, 0x3}}}, 0x90) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CAP_HYPERV_ENLIGHTENED_VMCS(r4, 0x4068aea3, &(0x7f00000002c0)={0xa3, 0x0, &(0x7f0000000040)}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2.548746229s ago: executing program 1 (id=5099): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r0, 0x6, 0x19, 0x0, &(0x7f0000000000)) 1.839780822s ago: executing program 1 (id=5100): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) io_setup(0x20, &(0x7f0000001140)=0x0) io_submit(r6, 0x1, &(0x7f00000001c0)=[&(0x7f0000002040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r5, &(0x7f0000000080)="0d32818e7e6ae0", 0x7}]) 1.741059721s ago: executing program 5 (id=5101): ioctl$KVM_CAP_PTP_KVM(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000100)) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, &(0x7f0000000040)=@s={0x5, @generic, 0xc, 0xb4}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000200)=@newtaction={0x14, 0x30, 0x2, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4044}, 0x4008804) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect(0x3, 0x36, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) r3 = socket(0xa, 0x3, 0x3a) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000080)={0x0, 0x0, 0x0, r5}, 0xc) write(r2, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) r6 = getpgrp(0x0) fcntl$setownex(r1, 0xf, &(0x7f0000000100)={0x2, r6}) getpgrp(r6) 1.389243868s ago: executing program 1 (id=5102): r0 = socket(0x2b, 0x1, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000580)=0xe) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000080)=0x7f) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) socket$l2tp(0x2, 0x2, 0x73) r3 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) ioctl$VIDIOC_G_SELECTION(r7, 0xc040565e, &(0x7f00000003c0)={0xa, 0x0, 0x0, {0x80000004, 0x1, 0x2, 0x8800001}}) sendto$inet6(r6, &(0x7f0000000180)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e", 0x87, 0x0, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f00000000c0)=0x6) dup3(r2, r3, 0x80000) capget(&(0x7f0000000140)={0x20080522, 0xffffffffffffffff}, &(0x7f0000000180)={0x7, 0x8, 0x6, 0x8, 0x1, 0xffffffff}) read$dsp(r1, &(0x7f00000011c0)=""/4117, 0x200021d5) r8 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r8, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000029c0)=ANY=[], 0x14}}, 0x0) sendmsg$IPSET_CMD_SWAP(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14000000060601"], 0x14}}, 0x810) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) 989.512189ms ago: executing program 5 (id=5103): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000000c0), 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f0000000000)={&(0x7f0000000040)={0x1d, r1, 0x0, 0xf4010000}, 0x10, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="0400"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=r0, @ANYRES64=r1, @ANYBLOB="000000000100000000000000840004"], 0x48}}, 0x0) 875.062117ms ago: executing program 5 (id=5104): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1221}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_TTL={0x5, 0x4, 0x5f}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @local}]}}}]}, 0x40}}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=@newsa={0xf0, 0x10, 0x1, 0x8000000, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {@in=@broadcast, 0x0, 0x33}, @in=@local, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x5680000000}, {0x10, 0x9}, 0x0, 0x0, 0x2, 0x1}}, 0xf0}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffebe}, 0x90) r1 = syz_io_uring_setup(0x24fa, &(0x7f0000000b80)={0x0, 0x1, 0x10100, 0x10, 0x4033a}, &(0x7f0000000300)=0x0, &(0x7f00000004c0)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='8'], 0x38}}, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r4, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r1, 0x2d3e, 0x0, 0x40, 0x0, 0x0) 619.721347ms ago: executing program 5 (id=5105): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x141a82, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00'}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004640)={0x0}, 0x1, 0x0, 0x0, 0x200480c4}, 0x0) r5 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x4924924924924b9, 0x0) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x20000253) (fail_nth: 1) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x240088c1}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) 336.283063ms ago: executing program 2 (id=5106): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x141a82, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'veth1_to_bridge\x00'}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000004640)={0x0}, 0x1, 0x0, 0x0, 0x200480c4}, 0x0) r5 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x4924924924924b9, 0x0) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x20000253) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)={{0x14}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x240088c1}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) 0s ago: executing program 0 (id=5107): socket$rds(0x15, 0x5, 0x0) unshare(0x26020480) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f0000000040)=ANY=[]) kernel console output (not intermixed with test programs): hub [ 1374.466166][T11215] usb 1-1: config 9 has an invalid interface number: 207 but max is 0 [ 1374.476622][T11215] usb 1-1: config 9 has no interface number 0 [ 1374.485061][T11215] usb 1-1: config 9 interface 207 has no altsetting 0 [ 1374.497208][T11215] usb 1-1: New USB device found, idVendor=0545, idProduct=800d, bcdDevice= 3.0a [ 1374.507039][T11215] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1374.517375][T11215] usb 1-1: Product: syz [ 1374.521548][T11215] usb 1-1: Manufacturer: syz [ 1374.527242][T11215] usb 1-1: SerialNumber: syz [ 1374.642603][T13735] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1374.793554][T11215] usb 1-1: USB disconnect, device number 101 [ 1374.796669][T13735] usb 2-1: device descriptor read/64, error -71 [ 1375.064033][T13735] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1375.223063][T13735] usb 2-1: device descriptor read/64, error -71 [ 1375.342744][T13735] usb usb2-port1: attempt power cycle [ 1375.412429][T11215] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1375.562487][T11215] usb 5-1: Using ep0 maxpacket: 8 [ 1375.572676][T11215] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1375.583461][T11215] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1375.595798][T11215] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1375.607038][T11215] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1375.618128][T11215] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1375.631641][T11215] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1375.642538][T11215] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1375.702994][T13735] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 1375.734046][T13735] usb 2-1: device descriptor read/8, error -71 [ 1375.872041][T11215] usb 5-1: usb_control_msg returned -32 [ 1375.878020][T11215] usbtmc 5-1:16.0: can't read capabilities [ 1375.996982][T13735] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1376.032105][T13735] usb 2-1: device descriptor read/8, error -71 [ 1376.157192][T13735] usb usb2-port1: unable to enumerate USB device [ 1377.016282][T23667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1377.025704][T23667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1377.041578][T23667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1377.091008][T23667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1378.101809][ T44] usb 5-1: USB disconnect, device number 86 [ 1378.523031][ T44] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1378.697664][ T44] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1378.707855][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1378.718446][ T44] usb 5-1: Product: syz [ 1378.722660][ T44] usb 5-1: Manufacturer: syz [ 1378.727236][ T44] usb 5-1: SerialNumber: syz [ 1378.749918][T23683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1378.759154][T23683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1378.904139][T23684] netlink: 'syz.0.4723': attribute type 21 has an invalid length. [ 1378.912111][T23684] __nla_validate_parse: 9 callbacks suppressed [ 1378.912128][T23684] netlink: 156 bytes leftover after parsing attributes in process `syz.0.4723'. [ 1379.172448][T11215] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 1379.187109][ T44] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1379.206262][ T44] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1379.219585][ T44] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1379.244102][ T44] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -32 [ 1379.302463][T11215] usb 1-1: device descriptor read/64, error -71 [ 1379.547039][T11215] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 1379.682552][T11215] usb 1-1: device descriptor read/64, error -71 [ 1379.792670][T11215] usb usb1-port1: attempt power cycle [ 1380.134803][T11215] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 1380.153787][ T44] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1380.171724][T11215] usb 1-1: device descriptor read/8, error -71 [ 1380.197180][T23696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1380.208458][T23696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1380.230463][T23698] binder: 23697:23698 ioctl c0306201 200000000080 returned -14 [ 1380.250437][T23698] binder_alloc: 23697: binder_alloc_buf, no vma [ 1380.326304][ T44] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1380.343646][ T44] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1380.357573][ T44] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1380.368706][ T44] usb 2-1: config 0 descriptor?? [ 1380.381503][ T44] pwc: Askey VC010 type 2 USB webcam detected. [ 1380.413013][T11215] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 1380.438031][T11215] usb 1-1: device descriptor read/8, error -71 [ 1380.553148][T11215] usb usb1-port1: unable to enumerate USB device [ 1380.574330][T23710] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4732'. [ 1380.651251][T23712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1380.662316][T23712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1380.787782][ T44] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1381.014375][ T44] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1381.021280][ T44] pwc: recv_control_msg error -71 req 04 val 1000 [ 1381.028357][ T44] pwc: recv_control_msg error -71 req 04 val 1300 [ 1381.035311][ T44] pwc: recv_control_msg error -71 req 04 val 1400 [ 1381.042397][ T44] pwc: recv_control_msg error -71 req 02 val 2000 [ 1381.049641][ T44] pwc: recv_control_msg error -71 req 02 val 2100 [ 1381.057798][ T44] pwc: recv_control_msg error -71 req 04 val 1500 [ 1381.066157][ T44] pwc: recv_control_msg error -71 req 02 val 2500 [ 1381.074422][ T44] pwc: recv_control_msg error -71 req 02 val 2400 [ 1381.084768][ T44] pwc: recv_control_msg error -71 req 02 val 2600 [ 1381.091821][ T44] pwc: recv_control_msg error -71 req 02 val 2900 [ 1381.099324][ T44] pwc: recv_control_msg error -71 req 02 val 2800 [ 1381.107714][ T44] pwc: recv_control_msg error -71 req 04 val 1100 [ 1381.115166][ T44] pwc: recv_control_msg error -71 req 04 val 1200 [ 1381.130430][ T44] pwc: Registered as video103. [ 1381.139333][ T44] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input62 [ 1381.167684][ T44] usb 2-1: USB disconnect, device number 11 [ 1381.270889][ T919] usb 5-1: USB disconnect, device number 87 [ 1381.717331][ T919] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1381.904242][ T919] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1381.916977][ T919] usb 5-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1381.927826][ T919] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1381.936488][ T919] usb 5-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 1381.947640][ T919] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1381.958983][ T919] usb 5-1: config 0 descriptor?? [ 1382.405878][ T919] logitech 0003:046D:C24F.003C: unknown main item tag 0x0 [ 1382.414707][ T919] logitech 0003:046D:C24F.003C: unknown main item tag 0x0 [ 1382.421893][ T919] logitech 0003:046D:C24F.003C: unknown main item tag 0x0 [ 1382.429535][ T919] logitech 0003:046D:C24F.003C: unknown main item tag 0x0 [ 1382.454264][ T919] logitech 0003:046D:C24F.003C: hidraw0: USB HID v0.05 Device [HID 046d:c24f] on usb-dummy_hcd.4-1/input0 [ 1382.470094][ T919] logitech 0003:046D:C24F.003C: no inputs found [ 1382.756736][T23721] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1382.768140][T23721] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1384.655594][T23755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1384.738894][T23755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1384.770465][ T919] usb 5-1: USB disconnect, device number 88 [ 1385.302518][ T44] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1385.511194][ T44] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1385.535629][ T44] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1385.544794][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1385.553418][ T44] usb 5-1: Product: syz [ 1385.557579][ T44] usb 5-1: Manufacturer: syz [ 1385.562148][ T44] usb 5-1: SerialNumber: syz [ 1385.576661][ T44] usb 5-1: config 0 descriptor?? [ 1385.877252][ T44] usb 5-1: USB disconnect, device number 89 [ 1386.670316][T23774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1386.742723][T23774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1386.819905][T13735] raw-gadget.1 gadget.2: failed to queue reset event [ 1386.892482][T13735] raw-gadget.1 gadget.2: failed to queue resume event [ 1386.952402][T13735] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 1386.960274][ C1] raw-gadget.1 gadget.2: ignoring, device is not running [ 1386.968389][T13735] raw-gadget.1 gadget.2: failed to queue reset event [ 1387.042442][T13735] raw-gadget.1 gadget.2: failed to queue resume event [ 1387.112387][T13735] usb 3-1: device descriptor read/64, error -32 [ 1387.233944][T13735] raw-gadget.1 gadget.2: failed to queue suspend event [ 1387.241236][T13735] raw-gadget.1 gadget.2: failed to queue reset event [ 1387.362612][T13735] raw-gadget.1 gadget.2: failed to queue resume event [ 1387.432755][T13735] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 1387.441546][ C1] raw-gadget.1 gadget.2: ignoring, device is not running [ 1387.449859][T23781] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1387.454536][T13735] raw-gadget.1 gadget.2: failed to queue reset event [ 1387.466039][T23779] sit1: entered allmulticast mode [ 1387.470864][T23781] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1387.502092][T23785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1387.535397][T23785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1387.536656][T13735] raw-gadget.1 gadget.2: failed to queue resume event [ 1387.602819][T13735] usb 3-1: device descriptor read/64, error -32 [ 1387.712615][T13735] raw-gadget.1 gadget.2: failed to queue suspend event [ 1387.720016][T13735] usb usb3-port1: attempt power cycle [ 1387.727898][T13735] raw-gadget.1 gadget.2: failed to queue disconnect event [ 1387.735707][T13735] raw-gadget.1 gadget.2: failed to queue reset event [ 1387.812552][T13735] raw-gadget.1 gadget.2: failed to queue resume event [ 1387.819687][T13735] raw-gadget.1 gadget.2: failed to queue reset event [ 1387.858062][T23793] FAULT_INJECTION: forcing a failure. [ 1387.858062][T23793] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1387.872376][T23793] CPU: 1 UID: 0 PID: 23793 Comm: syz.5.4752 Not tainted syzkaller #0 PREEMPT(full) [ 1387.872399][T23793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1387.872410][T23793] Call Trace: [ 1387.872418][T23793] [ 1387.872425][T23793] dump_stack_lvl+0x189/0x250 [ 1387.872450][T23793] ? __pfx____ratelimit+0x10/0x10 [ 1387.872468][T23793] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1387.872487][T23793] ? __pfx__printk+0x10/0x10 [ 1387.872509][T23793] ? __might_fault+0xb0/0x130 [ 1387.872545][T23793] should_fail_ex+0x414/0x560 [ 1387.872572][T23793] _copy_from_user+0x2d/0xb0 [ 1387.872596][T23793] lo_ioctl+0x53c/0x1c10 [ 1387.872628][T23793] ? __pfx_lo_ioctl+0x10/0x10 [ 1387.872649][T23793] ? ima_match_policy+0x10b/0x2150 [ 1387.872671][T23793] ? look_up_lock_class+0x74/0x170 [ 1387.872691][T23793] ? register_lock_class+0x51/0x320 [ 1387.872720][T23793] ? __lock_acquire+0xab9/0xd20 [ 1387.872754][T23793] ? process_measurement+0x3d8/0x1a40 [ 1387.872785][T23793] ? xfd_validate_state+0x6d/0x150 [ 1387.872801][T23793] ? save_fpregs_to_fpstate+0xa3/0x210 [ 1387.872829][T23793] ? rcu_is_watching+0x15/0xb0 [ 1387.872848][T23793] ? __switch_to+0xdae/0x1670 [ 1387.872874][T23793] ? __lock_acquire+0xab9/0xd20 [ 1387.872902][T23793] ? finish_task_switch+0x18b/0x950 [ 1387.872936][T23793] ? finish_task_switch+0x266/0x950 [ 1387.872957][T23793] ? lockdep_hardirqs_on+0x9c/0x150 [ 1387.872976][T23793] ? finish_task_switch+0x266/0x950 [ 1387.872999][T23793] ? rcu_is_watching+0x15/0xb0 [ 1387.873018][T23793] ? trace_sched_exit_tp+0x36/0x110 [ 1387.873047][T23793] ? __schedule+0x17ae/0x4cc0 [ 1387.873088][T23793] ? __pfx___schedule+0x10/0x10 [ 1387.873109][T23793] ? stack_trace_save+0x9c/0xe0 [ 1387.873134][T23793] ? stack_depot_save_flags+0x40/0x860 [ 1387.873158][T23793] ? rcu_is_watching+0x15/0xb0 [ 1387.873177][T23793] ? trace_irq_disable+0x37/0x110 [ 1387.873199][T23793] ? preempt_schedule_irq+0xde/0x150 [ 1387.873217][T23793] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 1387.873233][T23793] ? security_file_ioctl+0xcb/0x2d0 [ 1387.873261][T23793] ? irqentry_exit+0x74/0x90 [ 1387.873279][T23793] ? lockdep_hardirqs_on+0x9c/0x150 [ 1387.873313][T23793] ? __asan_memset+0x22/0x50 [ 1387.873333][T23793] ? blk_get_meta_cap+0x140/0x710 [ 1387.873356][T23793] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 1387.873374][T23793] ? kasan_quarantine_put+0xdd/0x220 [ 1387.873405][T23793] ? blkdev_common_ioctl+0xff7/0x2550 [ 1387.873425][T23793] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1387.873451][T23793] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 1387.873472][T23793] ? do_vfs_ioctl+0xbe8/0x1430 [ 1387.873531][T23793] ? __pfx_lo_ioctl+0x10/0x10 [ 1387.873555][T23793] blkdev_ioctl+0x5a5/0x6d0 [ 1387.873578][T23793] ? __pfx_blkdev_ioctl+0x10/0x10 [ 1387.873601][T23793] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1387.873622][T23793] ? __pfx_blkdev_ioctl+0x10/0x10 [ 1387.873641][T23793] __se_sys_ioctl+0xfc/0x170 [ 1387.873665][T23793] do_syscall_64+0xfa/0x3b0 [ 1387.873683][T23793] ? lockdep_hardirqs_on+0x9c/0x150 [ 1387.873701][T23793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1387.873719][T23793] ? clear_bhb_loop+0x60/0xb0 [ 1387.873741][T23793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1387.873758][T23793] RIP: 0033:0x7f3b7d38eec9 [ 1387.873775][T23793] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1387.873792][T23793] RSP: 002b:00007f3b7e2b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1387.873811][T23793] RAX: ffffffffffffffda RBX: 00007f3b7d5e5fa0 RCX: 00007f3b7d38eec9 [ 1387.873825][T23793] RDX: 00002000000002c0 RSI: 0000000000004c0a RDI: 0000000000000004 [ 1387.873837][T23793] RBP: 00007f3b7e2b9090 R08: 0000000000000000 R09: 0000000000000000 [ 1387.873850][T23793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1387.873861][T23793] R13: 00007f3b7d5e6038 R14: 00007f3b7d5e5fa0 R15: 00007f3b7d70fa28 [ 1387.873891][T23793] [ 1388.284089][T13735] raw-gadget.1 gadget.2: failed to queue resume event [ 1388.343176][T13735] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 1388.364275][ C1] raw-gadget.1 gadget.2: ignoring, device is not running [ 1388.371618][T13735] usb 3-1: device descriptor read/8, error -32 [ 1388.482545][T13735] raw-gadget.1 gadget.2: failed to queue suspend event [ 1388.489884][T13735] raw-gadget.1 gadget.2: failed to queue reset event [ 1388.562555][T13735] raw-gadget.1 gadget.2: failed to queue resume event [ 1388.632463][T13735] usb 3-1: new high-speed USB device number 123 using dummy_hcd [ 1388.655902][ C1] raw-gadget.1 gadget.2: ignoring, device is not running [ 1388.663245][T13735] usb 3-1: device descriptor read/8, error -32 [ 1388.762511][ T44] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1388.776235][T23799] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1388.792241][T13735] raw-gadget.1 gadget.2: failed to queue suspend event [ 1388.799566][ T919] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 1388.809643][T13735] usb usb3-port1: unable to enumerate USB device [ 1388.918167][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1388.932056][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1388.950719][T23799] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1388.958215][ T44] usb 2-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1388.972700][ T919] usb 1-1: Using ep0 maxpacket: 8 [ 1388.983602][ T919] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 1388.992972][ T44] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1389.004996][ T919] usb 1-1: config 0 has no interface number 0 [ 1389.011328][ T919] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1389.045896][ T44] usb 2-1: config 0 descriptor?? [ 1389.058035][ T919] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1389.076237][ T919] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1389.087630][ T919] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1389.101257][ T919] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1389.110647][ T919] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1389.128130][ T919] usb 1-1: config 0 descriptor?? [ 1389.173710][ T919] ldusb 1-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 1390.106040][ T44] hid-led 0003:27B8:01ED.003D: probe with driver hid-led failed with error -71 [ 1390.119682][ T44] usb 2-1: USB disconnect, device number 12 [ 1390.922583][ T1212] usb 5-1: new full-speed USB device number 90 using dummy_hcd [ 1391.062383][ T1212] usb 5-1: device descriptor read/64, error -71 [ 1391.312453][ T1212] usb 5-1: new full-speed USB device number 91 using dummy_hcd [ 1391.442370][ T1212] usb 5-1: device descriptor read/64, error -71 [ 1391.456951][T11215] usb 1-1: USB disconnect, device number 106 [ 1391.469179][T11215] ldusb 1-1:0.55: LD USB Device #1 now disconnected [ 1391.555617][ T1212] usb usb5-port1: attempt power cycle [ 1391.922572][ T1212] usb 5-1: new full-speed USB device number 92 using dummy_hcd [ 1391.945658][ T1212] usb 5-1: device descriptor read/8, error -71 [ 1392.182368][ T1212] usb 5-1: new full-speed USB device number 93 using dummy_hcd [ 1392.212971][ T1212] usb 5-1: device descriptor read/8, error -71 [ 1392.324642][ T1212] usb usb5-port1: unable to enumerate USB device [ 1393.019255][T23827] netlink: 100 bytes leftover after parsing attributes in process `syz.1.4760'. [ 1393.265235][T23836] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4764'. [ 1393.333112][T23836] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4764'. [ 1393.382477][T23836] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4764'. [ 1393.394596][T23836] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4764'. [ 1393.417069][T23836] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4764'. [ 1393.432684][T23836] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4764'. [ 1393.598481][T23836] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4764'. [ 1393.616390][T23836] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4764'. [ 1393.644607][T23836] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4764'. [ 1394.209857][T23842] netlink: 'syz.4.4765': attribute type 1 has an invalid length. [ 1394.552516][ T919] usb 1-1: new high-speed USB device number 107 using dummy_hcd [ 1394.570563][T23851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1394.605390][T23851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1394.694358][T23853] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1394.715913][T23853] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1394.724329][ T919] usb 1-1: Using ep0 maxpacket: 8 [ 1394.737711][ T919] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1394.747261][ T919] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.755290][ T919] usb 1-1: Product: syz [ 1394.759591][ T919] usb 1-1: Manufacturer: syz [ 1394.764616][ T919] usb 1-1: SerialNumber: syz [ 1394.774319][ T919] usb 1-1: config 0 descriptor?? [ 1394.804271][ T44] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1394.902403][T13735] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1395.082568][T13735] usb 2-1: Using ep0 maxpacket: 32 [ 1395.098002][T13735] usb 2-1: config 0 has an invalid interface number: 42 but max is 0 [ 1395.109143][T13735] usb 2-1: config 0 has no interface number 0 [ 1395.120508][T13735] usb 2-1: New USB device found, idVendor=1bcf, idProduct=0b40, bcdDevice=42.27 [ 1395.132835][T13735] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1395.141572][T13735] usb 2-1: Product: syz [ 1395.146734][T13735] usb 2-1: Manufacturer: syz [ 1395.151529][T13735] usb 2-1: SerialNumber: syz [ 1395.182819][T13735] usb 2-1: config 0 descriptor?? [ 1395.438852][T13735] usb 2-1: Found UVC 0.00 device syz (1bcf:0b40) [ 1395.445909][T13735] usb 2-1: Forcing UVC version to 1.0a [ 1395.451780][T13735] usb 2-1: No valid video chain found. [ 1395.463853][T13735] usb 2-1: USB disconnect, device number 13 [ 1395.592705][T23874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1395.667671][T23874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1395.856027][ T919] dvb_usb_rtl28xxu 1-1:0.0: chip type detection failed -110 [ 1395.864038][ T919] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 1396.065092][ T1212] usb 1-1: USB disconnect, device number 107 [ 1396.524224][T23893] program syz.4.4780 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1396.594901][T23895] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1396.603782][T23895] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1396.974692][ T919] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1397.132395][ T919] usb 5-1: Using ep0 maxpacket: 32 [ 1397.139152][ T919] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1397.150461][ T919] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1397.163279][ T919] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1397.174548][ T919] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1397.185774][ T919] usb 5-1: config 0 descriptor?? [ 1397.203725][ T919] hub 5-1:0.0: USB hub found [ 1397.312005][T23906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1397.328253][T23906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1397.400021][ T919] hub 5-1:0.0: 1 port detected [ 1398.285867][ T919] hub 5-1:0.0: activate --> -90 [ 1398.600478][ T919] usb 5-1-port1: cannot disable (err = -71) [ 1398.603455][ T5877] usb 5-1: USB disconnect, device number 95 [ 1398.843892][ T1212] usb 1-1: new high-speed USB device number 108 using dummy_hcd [ 1399.002374][ T1212] usb 1-1: Using ep0 maxpacket: 16 [ 1399.009098][ T1212] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 1399.017296][ T1212] usb 1-1: config 0 has no interface number 0 [ 1399.027360][ T1212] usb 1-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1399.036743][ T1212] usb 1-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1399.045078][ T1212] usb 1-1: Product: syz [ 1399.049234][ T1212] usb 1-1: SerialNumber: syz [ 1399.057674][ T1212] usb 1-1: config 0 descriptor?? [ 1399.066875][ T1212] input: CM109 USB driver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.8/input/input63 [ 1399.337368][T23913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1399.354878][T23913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1399.492971][T23922] __nla_validate_parse: 11 callbacks suppressed [ 1399.492992][T23922] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4789'. [ 1399.683063][ T919] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1399.834711][ T919] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1399.848032][ T919] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1399.857718][ T919] usb 5-1: config 1 has no interface number 1 [ 1399.866092][ T919] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 1399.879619][ T919] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 1399.952566][ T919] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1399.962542][ T919] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1399.975631][ T919] usb 5-1: Product: syz [ 1399.982965][ T919] usb 5-1: Manufacturer: syz [ 1399.988329][ T919] usb 5-1: SerialNumber: syz [ 1400.007064][T23921] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 1400.242374][ T919] usb 5-1: 2:1 : no or invalid class specific endpoint descriptor [ 1400.250424][ T919] usb 5-1: 2:1 : no or invalid class specific endpoint descriptor [ 1400.292877][ T919] usb 5-1: USB disconnect, device number 96 [ 1400.327394][ T6302] udevd[6302]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1400.637151][T23936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1400.655171][T23936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1400.673633][T23936] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1401.346610][T23942] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1401.365829][T23942] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1401.747609][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.747797][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.747978][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.748152][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.748323][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.748493][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.748672][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.748845][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.749017][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.749185][ C0] cm109 1-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1401.753019][ T5877] usb 1-1: USB disconnect, device number 108 [ 1401.753075][ C0] cm109 1-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1401.823161][ T1212] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1401.853986][ T5877] cm109 1-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1402.051892][ T1212] usb 5-1: Using ep0 maxpacket: 8 [ 1402.081206][T23955] netlink: 84 bytes leftover after parsing attributes in process `syz.1.4796'. [ 1402.112640][ T1212] usb 5-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1402.112673][ T1212] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1402.112693][ T1212] usb 5-1: Product: syz [ 1402.112708][ T1212] usb 5-1: Manufacturer: syz [ 1402.112723][ T1212] usb 5-1: SerialNumber: syz [ 1402.115965][ T1212] usb 5-1: config 0 descriptor?? [ 1402.142484][T23955] fuse: Bad value for 'fd' [ 1402.145761][T23958] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1402.146566][T23958] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1402.169370][ T1212] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1402.478263][ T1212] gspca_sonixj: reg_w1 err -71 [ 1402.489108][ T1212] sonixj 5-1:0.0: probe with driver sonixj failed with error -71 [ 1402.501282][ T1212] usb 5-1: USB disconnect, device number 97 [ 1403.499495][ T1212] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 1403.652484][ T1212] usb 5-1: Using ep0 maxpacket: 32 [ 1403.659091][ T1212] usb 5-1: config index 0 descriptor too short (expected 36, got 31) [ 1403.669149][ T1212] usb 5-1: config 0 has an invalid interface number: 83 but max is 0 [ 1403.677426][ T1212] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1403.688228][ T1212] usb 5-1: config 0 has no interface number 0 [ 1403.694703][ T1212] usb 5-1: config 0 interface 83 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 1403.704728][ T1212] usb 5-1: config 0 interface 83 altsetting 0 bulk endpoint 0xF has invalid maxpacket 0 [ 1403.714546][ T1212] usb 5-1: config 0 interface 83 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1403.729919][ T1212] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=d8.11 [ 1403.739270][ T1212] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=232 [ 1403.747815][ T1212] usb 5-1: Product: syz [ 1403.753298][ T1212] usb 5-1: Manufacturer: syz [ 1403.757887][ T1212] usb 5-1: SerialNumber: syz [ 1403.773755][ T1212] usb 5-1: config 0 descriptor?? [ 1403.785947][ T1212] redrat3 5-1:0.83: Couldn't find all endpoints [ 1404.142475][T23972] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1404.155377][T23972] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1404.196188][T23972] bond0 (unregistering): Released all slaves [ 1404.356190][T13735] usb 5-1: USB disconnect, device number 98 [ 1404.932344][T13735] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1405.094340][T13735] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1405.103658][T13735] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1405.114619][T13735] usb 2-1: config 0 descriptor?? [ 1405.123641][T13735] cp210x 2-1:0.0: cp210x converter detected [ 1405.164720][ T1212] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 1405.262084][T24002] netlink: 84 bytes leftover after parsing attributes in process `syz.5.4813'. [ 1405.326218][ T1212] usb 5-1: Using ep0 maxpacket: 8 [ 1405.359179][ T1212] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x99, changing to 0x89 [ 1405.371312][ T1212] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1405.383841][ T1212] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1405.393121][ T1212] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1405.401146][ T1212] usb 5-1: Product: syz [ 1405.405529][ T1212] usb 5-1: Manufacturer: syz [ 1405.410111][ T1212] usb 5-1: SerialNumber: syz [ 1405.418116][ T1212] usb 5-1: config 0 descriptor?? [ 1405.466808][ T1212] streamzap 5-1:0.0: streamzap_probe: endpoint attributes don't match xfer 0200 [ 1405.519627][T24002] fuse: Bad value for 'fd' [ 1405.541293][T13735] cp210x 2-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 1405.570051][T13735] usb 2-1: cp210x converter now attached to ttyUSB0 [ 1405.715667][ T1212] usb 5-1: USB disconnect, device number 99 [ 1405.803458][ T44] usb 2-1: USB disconnect, device number 14 [ 1405.815645][ T44] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1405.872662][ T44] cp210x 2-1:0.0: device disconnected [ 1405.936274][T13735] usb 1-1: new high-speed USB device number 109 using dummy_hcd [ 1406.114564][T13735] usb 1-1: Using ep0 maxpacket: 32 [ 1406.121208][T13735] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1406.130624][T13735] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1406.146667][T13735] usb 1-1: config 0 descriptor?? [ 1406.156411][T13735] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1406.431078][T24010] sctp: [Deprecated]: syz.4.4816 (pid 24010) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1406.431078][T24010] Use struct sctp_sack_info instead [ 1406.696064][T24024] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1406.707879][T24024] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1406.873137][ T5877] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 1407.027152][ T5877] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1407.039702][ T5877] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1407.050490][ T5877] usb 5-1: Product: syz [ 1407.054968][ T5877] usb 5-1: Manufacturer: syz [ 1407.059580][ T5877] usb 5-1: SerialNumber: syz [ 1407.067488][ T5877] usb 5-1: config 0 descriptor?? [ 1407.179052][ T1212] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 1407.322772][ T1212] usb 2-1: device descriptor read/64, error -71 [ 1407.558397][ T5877] usb 5-1: Firmware: major: 213, minor: 124, hardware type: UNKNOWN (48) [ 1407.570705][ T1212] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 1407.713077][ T1212] usb 2-1: device descriptor read/64, error -71 [ 1407.789418][ T5877] usb 5-1: Read permanent extended address 78:d9:cf:80:c4:56:f3:e4 from device [ 1407.800869][ T5877] usb 5-1: atusb_probe: initialization failed, error = -524 [ 1407.809950][ T5877] atusb 5-1:0.0: probe with driver atusb failed with error -524 [ 1407.825199][ T1212] usb usb2-port1: attempt power cycle [ 1408.018270][ T919] usb 5-1: USB disconnect, device number 100 [ 1408.051314][T13735] gspca_vc032x: reg_r err -71 [ 1408.056404][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.061761][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.069604][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.075786][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.081520][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.087152][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.092798][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.098070][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.103795][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.109087][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.114847][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.120374][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.126970][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.133795][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.139203][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.145259][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.150689][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.156739][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1408.162053][T13735] gspca_vc032x: Unknown sensor... [ 1408.162854][ T1212] usb 2-1: new full-speed USB device number 17 using dummy_hcd [ 1408.167841][T13735] vc032x 1-1:0.0: probe with driver vc032x failed with error -22 [ 1408.190925][T13735] usb 1-1: USB disconnect, device number 109 [ 1408.203777][ T1212] usb 2-1: device descriptor read/8, error -71 [ 1408.462598][ T1212] usb 2-1: new full-speed USB device number 18 using dummy_hcd [ 1408.484996][ T1212] usb 2-1: device descriptor read/8, error -71 [ 1408.592709][ T1212] usb usb2-port1: unable to enumerate USB device [ 1409.063422][T13735] usb 1-1: new high-speed USB device number 110 using dummy_hcd [ 1409.232653][T13735] usb 1-1: Using ep0 maxpacket: 8 [ 1409.241876][T13735] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x99, changing to 0x89 [ 1409.253913][ T919] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 1409.261689][T13735] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1409.277652][T13735] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1409.288168][T13735] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1409.299429][T13735] usb 1-1: Product: syz [ 1409.304097][T13735] usb 1-1: Manufacturer: syz [ 1409.308996][T13735] usb 1-1: SerialNumber: syz [ 1409.325272][T13735] usb 1-1: config 0 descriptor?? [ 1409.337242][T13735] streamzap 1-1:0.0: streamzap_probe: endpoint attributes don't match xfer 0200 [ 1409.351800][T24055] netlink: 84 bytes leftover after parsing attributes in process `syz.5.4829'. [ 1409.412469][T24055] fuse: Bad value for 'fd' [ 1409.424693][ T919] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1409.435820][ T919] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1409.447016][ T919] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1409.457286][ T919] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1409.479319][ T919] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1409.488519][ T919] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1409.496733][ T919] usb 5-1: Manufacturer: syz [ 1409.506351][ T919] usb 5-1: config 0 descriptor?? [ 1409.541442][T13735] usb 1-1: USB disconnect, device number 110 [ 1409.935633][ T919] appleir 0003:05AC:8243.003E: unknown main item tag 0x0 [ 1409.951395][ T919] appleir 0003:05AC:8243.003E: hiddev1,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 1410.149833][ T919] usb 5-1: USB disconnect, device number 101 [ 1410.465298][T24067] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4831'. [ 1410.474559][T24067] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4831'. [ 1410.733483][T24074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1410.779630][T24074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1411.708892][T24101] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4844'. [ 1411.756145][T24104] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1411.766650][T24104] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1412.967995][T24124] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1413.002357][ T1212] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 1413.168544][ T1212] usb 2-1: config 0 has an invalid interface number: 64 but max is 0 [ 1413.178385][ T1212] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1413.188785][ T1212] usb 2-1: config 0 has no interface number 0 [ 1413.209114][ T1212] usb 2-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 1413.218652][ T1212] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1413.228933][ T1212] usb 2-1: Product: syz [ 1413.233642][ T1212] usb 2-1: Manufacturer: syz [ 1413.238222][ T1212] usb 2-1: SerialNumber: syz [ 1413.247260][ T1212] usb 2-1: config 0 descriptor?? [ 1413.260376][ T1212] usb 2-1: Found UVC 0.00 device syz (046d:0823) [ 1413.269209][ T1212] usb 2-1: No valid video chain found. [ 1413.933806][T13735] usb 1-1: new high-speed USB device number 111 using dummy_hcd [ 1414.103935][T13735] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1414.114613][T13735] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1414.131673][T13735] usb 1-1: config 0 descriptor?? [ 1414.145800][T13735] cp210x 1-1:0.0: cp210x converter detected [ 1414.558468][T13735] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 1414.581886][T13735] usb 1-1: cp210x converter now attached to ttyUSB0 [ 1414.884842][T24103] delete_channel: no stack [ 1414.918058][ T1212] usb 1-1: USB disconnect, device number 111 [ 1414.928781][ T1212] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1414.937922][ T1212] cp210x 1-1:0.0: device disconnected [ 1415.038791][T24148] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1415.058838][T24148] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1415.407143][T13735] usb 2-1: USB disconnect, device number 19 [ 1415.760081][T24174] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4866'. [ 1415.841778][T24177] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4868'. [ 1415.933206][T24175] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1416.153858][ T5962] usb 1-1: new high-speed USB device number 112 using dummy_hcd [ 1416.319936][ T5962] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1416.329263][ T5962] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1416.352584][ T1212] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 1416.374680][ T5962] usb 1-1: config 0 descriptor?? [ 1416.382081][ T5962] cp210x 1-1:0.0: cp210x converter detected [ 1416.514419][ T1212] usb 2-1: Using ep0 maxpacket: 8 [ 1416.528343][ T1212] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1416.536932][ T1212] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1416.549724][ T1212] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1416.560914][ T1212] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1416.576003][ T1212] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1416.589397][ T1212] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1416.601533][ T1212] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1416.868319][ T5962] cp210x 1-1:0.0: failed to get vendor val 0x370c size 13: -121 [ 1416.876147][ T5962] cp210x 1-1:0.0: GPIO initialisation failed: -121 [ 1416.926012][ T5962] usb 1-1: cp210x converter now attached to ttyUSB0 [ 1416.971437][T24186] netlink: 'syz.2.4870': attribute type 27 has an invalid length. [ 1417.182893][ T1212] usb 2-1: usb_control_msg returned -32 [ 1417.188516][ T1212] usbtmc 2-1:16.0: can't read capabilities [ 1417.522943][T24187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1417.574305][ C1] wdm_int_callback: 8273 callbacks suppressed [ 1417.574334][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.587086][ C1] wdm_int_callback: 8273 callbacks suppressed [ 1417.587105][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.599777][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.606453][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.612783][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.619445][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.625772][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.632435][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.638772][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.645434][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.651868][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.658544][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.664929][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.671593][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.678078][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.684743][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.691118][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.697784][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.704127][ C1] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1417.710791][ C1] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1417.730093][T24187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1418.425529][T24191] netlink: 212388 bytes leftover after parsing attributes in process `syz.4.4871'. [ 1418.726335][T24191] openvswitch: netlink: Message has 5 unknown bytes. [ 1418.806230][T24191] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1419.402808][ T1212] usb 2-1: USB disconnect, device number 20 [ 1419.523981][T24186] netdevsim netdevsim2 netdevsim0: left allmulticast mode [ 1419.577276][T24200] FAULT_INJECTION: forcing a failure. [ 1419.577276][T24200] name failslab, interval 1, probability 0, space 0, times 0 [ 1419.590798][T24200] CPU: 0 UID: 0 PID: 24200 Comm: syz.5.4873 Not tainted syzkaller #0 PREEMPT(full) [ 1419.590814][T24200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1419.590821][T24200] Call Trace: [ 1419.590826][T24200] [ 1419.590831][T24200] dump_stack_lvl+0x189/0x250 [ 1419.590848][T24200] ? __pfx____ratelimit+0x10/0x10 [ 1419.590860][T24200] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1419.590871][T24200] ? __pfx__printk+0x10/0x10 [ 1419.590888][T24200] ? __pfx___might_resched+0x10/0x10 [ 1419.590900][T24200] should_fail_ex+0x414/0x560 [ 1419.590919][T24200] should_failslab+0xa8/0x100 [ 1419.590935][T24200] __kmalloc_noprof+0xcb/0x4f0 [ 1419.590948][T24200] ? nf_tables_newset+0x132b/0x2530 [ 1419.590961][T24200] ? nla_strdup+0x9d/0x140 [ 1419.590970][T24200] ? trace_kmalloc+0x1f/0xd0 [ 1419.590984][T24200] nla_strdup+0x9d/0x140 [ 1419.590993][T24200] ? nft_bitmap_privsize+0x3f/0xc0 [ 1419.591007][T24200] nf_tables_newset+0x136a/0x2530 [ 1419.591027][T24200] ? __pfx_nf_tables_newset+0x10/0x10 [ 1419.591050][T24200] ? __nla_parse+0x40/0x60 [ 1419.591063][T24200] nfnetlink_rcv+0x1132/0x2520 [ 1419.591095][T24200] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1419.591118][T24200] ? ref_tracker_free+0x63a/0x7d0 [ 1419.591142][T24200] ? __netlink_deliver_tap+0x807/0x850 [ 1419.591153][T24200] ? netlink_deliver_tap+0x2e/0x1b0 [ 1419.591172][T24200] netlink_unicast+0x82c/0x9e0 [ 1419.591192][T24200] ? __pfx_netlink_unicast+0x10/0x10 [ 1419.591213][T24200] ? netlink_sendmsg+0x642/0xb30 [ 1419.591227][T24200] ? skb_put+0x11b/0x210 [ 1419.591248][T24200] netlink_sendmsg+0x805/0xb30 [ 1419.591284][T24200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1419.591302][T24200] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1419.591320][T24200] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1419.591336][T24200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1419.591363][T24200] __sock_sendmsg+0x21c/0x270 [ 1419.591390][T24200] ____sys_sendmsg+0x505/0x830 [ 1419.591418][T24200] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1419.591449][T24200] ? import_iovec+0x74/0xa0 [ 1419.591475][T24200] ___sys_sendmsg+0x21f/0x2a0 [ 1419.591499][T24200] ? __pfx____sys_sendmsg+0x10/0x10 [ 1419.591559][T24200] ? __fget_files+0x2a/0x420 [ 1419.591574][T24200] ? __fget_files+0x3a0/0x420 [ 1419.591602][T24200] __x64_sys_sendmsg+0x19b/0x260 [ 1419.591624][T24200] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1419.591652][T24200] ? __pfx_ksys_write+0x10/0x10 [ 1419.591671][T24200] ? rcu_is_watching+0x15/0xb0 [ 1419.591693][T24200] ? do_syscall_64+0xbe/0x3b0 [ 1419.591717][T24200] do_syscall_64+0xfa/0x3b0 [ 1419.591734][T24200] ? lockdep_hardirqs_on+0x9c/0x150 [ 1419.591752][T24200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1419.591770][T24200] ? clear_bhb_loop+0x60/0xb0 [ 1419.591792][T24200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1419.591809][T24200] RIP: 0033:0x7f3b7d38eec9 [ 1419.591826][T24200] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1419.591842][T24200] RSP: 002b:00007f3b7e2b9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1419.591861][T24200] RAX: ffffffffffffffda RBX: 00007f3b7d5e5fa0 RCX: 00007f3b7d38eec9 [ 1419.591874][T24200] RDX: 0000000000000040 RSI: 0000200000009b40 RDI: 0000000000000005 [ 1419.591887][T24200] RBP: 00007f3b7e2b9090 R08: 0000000000000000 R09: 0000000000000000 [ 1419.591898][T24200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1419.591909][T24200] R13: 00007f3b7d5e6038 R14: 00007f3b7d5e5fa0 R15: 00007f3b7d70fa28 [ 1419.591940][T24200] [ 1420.004422][T24186] vlan2: left allmulticast mode [ 1420.009301][T24186] veth0_to_hsr: left allmulticast mode [ 1420.015011][T24186] xfrm1: left promiscuous mode [ 1420.019756][T24186] xfrm1: left allmulticast mode [ 1420.070879][T24186] bond0: left promiscuous mode [ 1420.224779][ T3565] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.235763][ T3565] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.249789][ T3565] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.261734][ T3565] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.331221][ T919] usb 1-1: USB disconnect, device number 112 [ 1420.354234][T24210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1420.354597][ T919] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1420.371781][T24210] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1420.384557][ T919] cp210x 1-1:0.0: device disconnected [ 1420.533698][ T1212] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 1420.704248][ T1212] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1420.713550][ T1212] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1420.735858][ T1212] usb 2-1: config 0 descriptor?? [ 1420.749905][ T1212] cp210x 2-1:0.0: cp210x converter detected [ 1420.792723][ T5877] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 1420.811738][T24227] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4881'. [ 1420.952401][ T5877] usb 5-1: Using ep0 maxpacket: 32 [ 1420.972332][ T5877] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1421.001610][ T5877] usb 5-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1421.010857][ T5877] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1421.018963][ T5877] usb 5-1: Product: syz [ 1421.023369][ T5877] usb 5-1: Manufacturer: syz [ 1421.027984][ T5877] usb 5-1: SerialNumber: syz [ 1421.038480][ T5877] usb 5-1: config 0 descriptor?? [ 1421.061134][ T5877] usb 5-1: bad CDC descriptors [ 1421.070354][ T5877] usb 5-1: unsupported MDLM descriptors [ 1421.106113][T24226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1421.176153][T24226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1421.191492][ T1212] cp210x 2-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 1421.210241][ T1212] usb 2-1: cp210x converter now attached to ttyUSB0 [ 1421.259760][T24215] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1421.279883][T24215] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1421.290968][ T919] usb 5-1: USB disconnect, device number 102 [ 1421.433824][ T1212] usb 2-1: USB disconnect, device number 21 [ 1421.448464][ T1212] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1421.466220][ T1212] cp210x 2-1:0.0: device disconnected [ 1421.873484][T24236] netlink: 87 bytes leftover after parsing attributes in process `syz.2.4885'. [ 1421.923231][T24236] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1421.980789][T24236] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1422.110648][T24246] openvswitch: netlink: IP tunnel TTL not specified. [ 1422.593759][ T5877] usb 1-1: new high-speed USB device number 113 using dummy_hcd [ 1422.754208][ T5877] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1422.765320][ T5877] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1422.775781][ T5877] usb 1-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1422.784942][ T5877] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1422.794716][ T5877] usb 1-1: config 0 descriptor?? [ 1423.046918][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.053582][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.226591][ C0] raw-gadget.0 gadget.0: ignoring, device is not running [ 1423.242605][ C0] raw-gadget.0 gadget.0: ignoring, device is not running [ 1423.250471][ C0] raw-gadget.0 gadget.0: ignoring, device is not running [ 1423.257735][ T5877] usbhid 1-1:0.0: can't add hid device: -32 [ 1423.264135][ T5877] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 1423.276916][ T5877] usb 1-1: USB disconnect, device number 113 [ 1423.422501][T13735] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 1423.596569][T13735] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1423.606254][T13735] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1423.622098][T13735] usb 5-1: config 0 descriptor?? [ 1423.629566][T13735] cp210x 5-1:0.0: cp210x converter detected [ 1424.075388][T24290] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4903'. [ 1424.077788][T13735] cp210x 5-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 1424.120888][T13735] usb 5-1: cp210x converter now attached to ttyUSB0 [ 1424.316607][ T5877] usb 5-1: USB disconnect, device number 103 [ 1424.330625][ T5877] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1424.354324][ T5877] cp210x 5-1:0.0: device disconnected [ 1424.482525][ T1212] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 1424.633832][ T1212] usb 1-1: config 0 has an invalid interface number: 178 but max is 0 [ 1424.642067][ T1212] usb 1-1: config 0 has no interface number 0 [ 1424.648492][ T1212] usb 1-1: config 0 interface 178 altsetting 0 bulk endpoint 0xE has invalid maxpacket 8 [ 1424.661014][ T1212] usb 1-1: New USB device found, idVendor=05da, idProduct=00a3, bcdDevice=9d.36 [ 1424.670773][ T1212] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1424.684832][ T1212] usb 1-1: config 0 descriptor?? [ 1424.700231][T24292] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1424.792424][ T5877] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 1424.943982][ T5877] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1424.955647][ T5877] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1424.965786][ T1212] usb 1-1: string descriptor 0 read error: -71 [ 1424.973963][ T1212] microtek usb (rev 0.4.3): can only deal with bulk endpoints; endpoint 6 is not bulk. [ 1424.983899][ T5877] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1424.990518][ T1212] microtek usb (rev 0.4.3): can only deal with bulk endpoints; endpoint 11 is not bulk. [ 1425.000384][ T5877] usb 2-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 1425.009527][ T1212] microtek usb (rev 0.4.3): couldn't find two input bulk endpoints. Bailing out. [ 1425.018781][ T5877] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1425.030878][ T1212] usb 1-1: USB disconnect, device number 114 [ 1425.040175][ T5877] usb 2-1: config 0 descriptor?? [ 1425.472121][ T5877] logitech 0003:046D:C24F.003F: unknown main item tag 0x0 [ 1425.479790][ T5877] logitech 0003:046D:C24F.003F: unknown main item tag 0x0 [ 1425.487595][ T5877] logitech 0003:046D:C24F.003F: unknown main item tag 0x0 [ 1425.494896][ T5877] logitech 0003:046D:C24F.003F: unknown main item tag 0x0 [ 1425.506339][ T5877] logitech 0003:046D:C24F.003F: hidraw0: USB HID v0.05 Device [HID 046d:c24f] on usb-dummy_hcd.1-1/input0 [ 1425.518352][ T5877] logitech 0003:046D:C24F.003F: no inputs found [ 1425.704681][T24296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1425.716975][T24296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1425.751473][T24307] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1425.926541][ T5877] usb 2-1: USB disconnect, device number 22 [ 1426.252637][T13735] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 1426.405597][T13735] usb 5-1: Using ep0 maxpacket: 32 [ 1426.412478][T13735] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1426.421872][T13735] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1426.434365][T13735] usb 5-1: config 0 descriptor?? [ 1426.446834][T13735] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1426.630431][T24319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1426.652121][T24319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1426.680573][T24319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1426.697841][T24319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1426.726014][T24319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1426.738958][T24319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1426.768140][T24319] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1426.780688][T24319] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1427.036269][T10841] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1427.194533][T10841] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1427.204873][T10841] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1427.215265][T10841] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1427.224902][T10841] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1427.233481][T10841] usb 2-1: SerialNumber: syz [ 1427.489454][T24321] sit0: entered promiscuous mode [ 1427.559631][T24321] netlink: 'syz.1.4914': attribute type 1 has an invalid length. [ 1427.578321][T24321] netlink: 1 bytes leftover after parsing attributes in process `syz.1.4914'. [ 1427.692181][T24329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1427.727829][T24329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1428.084875][T13735] gspca_vc032x: reg_w err -71 [ 1428.090551][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.099970][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.110481][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.118610][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.124085][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.129549][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.137687][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.143186][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.148736][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.157222][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.163384][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.169499][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.178492][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.184107][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.189640][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.195708][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.201310][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.207136][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1428.214645][T13735] gspca_vc032x: Unknown sensor... [ 1428.219915][T13735] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 1428.230663][T13735] usb 5-1: USB disconnect, device number 104 [ 1428.257791][T10841] usb 2-1: 0:2 : does not exist [ 1428.275958][T10841] usb 2-1: USB disconnect, device number 23 [ 1428.308244][ T6485] udevd[6485]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1429.082508][T13735] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1429.256643][T13735] usb 2-1: Using ep0 maxpacket: 8 [ 1429.264694][T13735] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 1429.277707][T13735] usb 2-1: config 0 has no interface number 0 [ 1429.285034][T13735] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1429.299204][T13735] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1429.311191][T13735] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1429.324999][T13735] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1429.338413][T13735] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1429.349982][T13735] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1429.360130][T13735] usb 2-1: config 0 descriptor?? [ 1429.375788][T13735] ldusb 2-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 1430.898639][ T1212] usb 1-1: new full-speed USB device number 115 using dummy_hcd [ 1431.057034][ T1212] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1431.066977][ T1212] usb 1-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 1431.078796][ T1212] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1431.096339][ T1212] usb 1-1: config 0 descriptor?? [ 1431.514675][T24367] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1431.529637][T24367] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1431.568669][T24367] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1431.600170][T24367] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1431.636853][ T1212] nintendo 0003:057E:200E.0040: unbalanced delimiter at end of report description [ 1431.647667][ T1212] nintendo 0003:057E:200E.0040: HID parse failed [ 1431.668730][ T1212] nintendo 0003:057E:200E.0040: probe - fail = -22 [ 1431.677198][ T1212] nintendo 0003:057E:200E.0040: probe with driver nintendo failed with error -22 [ 1431.835040][ T1212] usb 1-1: USB disconnect, device number 115 [ 1432.301481][ T1212] usb 2-1: USB disconnect, device number 24 [ 1432.321021][ T1212] ldusb 2-1:0.55: LD USB Device #1 now disconnected [ 1432.374840][T18181] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1432.385853][T18181] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1432.394222][T18181] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1432.404658][T18181] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1432.412346][T18181] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1432.660035][T24382] chnl_net:caif_netlink_parms(): no params data found [ 1432.791285][T24382] bridge0: port 1(bridge_slave_0) entered blocking state [ 1432.803706][T24382] bridge0: port 1(bridge_slave_0) entered disabled state [ 1432.821222][T24382] bridge_slave_0: entered allmulticast mode [ 1432.831316][T24382] bridge_slave_0: entered promiscuous mode [ 1432.850247][T24382] bridge0: port 2(bridge_slave_1) entered blocking state [ 1432.863406][T24382] bridge0: port 2(bridge_slave_1) entered disabled state [ 1432.870695][T24382] bridge_slave_1: entered allmulticast mode [ 1432.884880][T24382] bridge_slave_1: entered promiscuous mode [ 1432.933778][T24398] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4934'. [ 1432.996321][T24382] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1433.008701][T24382] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1433.080167][T24401] input: syz1 as /devices/virtual/input/input65 [ 1433.292529][ T1212] usb 1-1: new high-speed USB device number 116 using dummy_hcd [ 1433.475052][ T1212] usb 1-1: config 0 has an invalid interface number: 64 but max is 0 [ 1433.483428][ T1212] usb 1-1: config 0 descriptor has 1 excess byte, ignoring [ 1433.490630][ T1212] usb 1-1: config 0 has no interface number 0 [ 1433.529990][ T1212] usb 1-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 1433.539478][ T1212] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1433.547594][ T1212] usb 1-1: Product: syz [ 1433.551885][ T1212] usb 1-1: Manufacturer: syz [ 1433.556600][ T1212] usb 1-1: SerialNumber: syz [ 1433.575178][ T1212] usb 1-1: config 0 descriptor?? [ 1433.585251][ T1212] uvcvideo 1-1:0.64: probe with driver uvcvideo failed with error -22 [ 1433.596438][T24382] team0: Port device team_slave_0 added [ 1433.608143][T24382] team0: Port device team_slave_1 added [ 1433.648914][T24382] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1433.659211][T24382] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1433.692445][T24382] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1433.705190][T24382] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1433.712147][T24382] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1433.738744][T24382] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1433.826865][T24382] hsr_slave_0: entered promiscuous mode [ 1433.834194][T24382] hsr_slave_1: entered promiscuous mode [ 1433.840395][T24382] debugfs: 'hsr0' already exists in 'hsr' [ 1433.846606][T24382] Cannot create hsr debugfs directory [ 1433.882606][ T1212] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 1434.092988][ T1212] usb 2-1: Using ep0 maxpacket: 8 [ 1434.119653][ T1212] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1434.128048][ T1212] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1434.138690][ T1212] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1434.148784][ T1212] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1434.159517][ T1212] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1434.172675][ T1212] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1434.181686][ T1212] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1434.201836][T24405] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4938'. [ 1434.439288][ T1212] usb 2-1: usb_control_msg returned -32 [ 1434.447938][ T1212] usbtmc 2-1:16.0: can't read capabilities [ 1434.477294][T24382] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1434.489147][T18181] Bluetooth: hci0: command tx timeout [ 1434.602567][T24382] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1434.622219][T24382] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1434.666850][T24382] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1434.868281][T24382] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1434.914197][ C0] wdm_int_callback: 8910 callbacks suppressed [ 1434.914221][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1434.926974][ C0] wdm_int_callback: 8910 callbacks suppressed [ 1434.926992][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1434.939670][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1434.946348][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1434.952753][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1434.959420][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1434.966801][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1434.973496][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1434.980425][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1434.987100][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1434.993516][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1435.000178][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1435.006498][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1435.013165][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1435.019557][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1435.026248][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1435.032682][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1435.039346][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1435.045752][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1435.052439][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1435.956595][T24433] loop6: detected capacity change from 0 to 7 [ 1436.400360][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1436.414612][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1436.424454][ T13] bond0 (unregistering): Released all slaves [ 1436.442003][ T13] bond1 (unregistering): Released all slaves [ 1436.460505][ T13] bond2 (unregistering): (slave bond3): Releasing backup interface [ 1436.470143][ T13] bond2 (unregistering): Released all slaves [ 1436.566004][T18181] Bluetooth: hci0: command tx timeout [ 1436.604990][T10841] usb 1-1: USB disconnect, device number 116 [ 1436.751940][ T13] bond3 (unregistering): Released all slaves [ 1436.830227][T24382] 8021q: adding VLAN 0 to HW filter on device team0 [ 1436.877467][ T3515] bridge0: port 1(bridge_slave_0) entered blocking state [ 1436.884748][ T3515] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1437.052842][ T1152] bridge0: port 2(bridge_slave_1) entered blocking state [ 1437.060009][ T1152] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1437.287407][T24382] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1437.366512][T24382] veth0_vlan: entered promiscuous mode [ 1437.384913][T24382] veth1_vlan: entered promiscuous mode [ 1437.424680][ T13] tipc: Left network mode [ 1437.480093][T24382] veth0_macvtap: entered promiscuous mode [ 1437.495424][T24382] veth1_macvtap: entered promiscuous mode [ 1437.536435][T24382] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1437.566067][T24382] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1437.939258][ T3515] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1437.950038][ T3515] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1438.009284][ T13] IPVS: stopping backup sync thread 7630 ... [ 1438.148493][ T3515] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1438.355747][T10841] usb 2-1: USB disconnect, device number 25 [ 1438.396781][T24455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1438.441359][ T3515] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1438.567711][T24455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1438.665493][T18181] Bluetooth: hci0: command tx timeout [ 1438.739030][ T3515] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1438.765454][ T3515] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1438.878627][ T1132] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1438.891614][ T1132] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1440.059538][T24493] input: syz1 as /devices/virtual/input/input66 [ 1440.132583][T13735] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 1440.295481][T13735] usb 1-1: Using ep0 maxpacket: 8 [ 1440.307393][T13735] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 1440.319080][T13735] usb 1-1: config 0 has no interface number 0 [ 1440.327173][T13735] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1440.341157][T13735] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1440.359998][T13735] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1440.375591][T13735] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1440.389209][T13735] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1440.401341][T13735] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1440.460833][T13735] usb 1-1: config 0 descriptor?? [ 1440.646596][T13735] ldusb 1-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 1440.740220][T18181] Bluetooth: hci0: command tx timeout [ 1440.882851][ T5877] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1441.068999][ T5877] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1441.084046][ T5877] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1441.096627][ T5877] usb 7-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1441.116718][ T5877] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1441.159540][ T5877] usb 7-1: config 0 descriptor?? [ 1441.279771][ T13] hsr_slave_0: left promiscuous mode [ 1441.288367][ T13] hsr_slave_1: left promiscuous mode [ 1441.294854][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1441.305534][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1441.989620][ T5877] hid-led 0003:27B8:01ED.0041: hidraw0: USB HID v0.00 Device [HID 27b8:01ed] on usb-dummy_hcd.6-1/input0 [ 1442.064479][ T5877] hid-led 0003:27B8:01ED.0041: ThingM blink(1) initialized [ 1442.134515][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1442.190784][ T5877] usb 7-1: USB disconnect, device number 2 [ 1442.290581][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1443.362901][ T5877] usb 7-1: new full-speed USB device number 3 using dummy_hcd [ 1443.525126][ T5877] usb 7-1: device descriptor read/64, error -71 [ 1443.690147][T24528] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4953'. [ 1443.774973][ T5877] usb 7-1: new full-speed USB device number 4 using dummy_hcd [ 1443.859493][T13735] usb 1-1: USB disconnect, device number 117 [ 1443.867947][T13735] ldusb 1-1:0.55: LD USB Device #1 now disconnected [ 1443.913327][ T5877] usb 7-1: device descriptor read/64, error -71 [ 1443.994541][T24536] input: syz1 as /devices/virtual/input/input67 [ 1444.031153][T24534] tipc: Enabled bearer , priority 0 [ 1444.039654][ T5877] usb usb7-port1: attempt power cycle [ 1444.089365][T24534] syzkaller0: entered promiscuous mode [ 1444.143398][T24534] syzkaller0: entered allmulticast mode [ 1444.208788][T24536] gretap2: entered allmulticast mode [ 1444.219986][T24540] tipc: Resetting bearer [ 1444.249054][T24531] tipc: Resetting bearer [ 1444.303007][ T1212] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 1444.349353][T24531] tipc: Disabling bearer [ 1444.382535][ T5877] usb 7-1: new full-speed USB device number 5 using dummy_hcd [ 1444.413892][ T5877] usb 7-1: device descriptor read/8, error -71 [ 1444.465342][ T1212] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1444.475884][ T1212] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1444.487707][ T1212] usb 1-1: Product: syz [ 1444.491931][ T1212] usb 1-1: Manufacturer: syz [ 1444.498500][ T1212] usb 1-1: SerialNumber: syz [ 1444.672481][ T5877] usb 7-1: new full-speed USB device number 6 using dummy_hcd [ 1444.695272][ T5877] usb 7-1: device descriptor read/8, error -71 [ 1444.800570][T24548] input: syz1 as /devices/virtual/input/input68 [ 1444.814237][ T5877] usb usb7-port1: unable to enumerate USB device [ 1444.940773][ T1212] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1444.957095][ T1212] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1444.971326][ T1212] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1444.983496][ T1212] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -32 [ 1445.473758][T24558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1445.514929][T24558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1446.159548][T24564] netlink: 'syz.5.4964': attribute type 1 has an invalid length. [ 1446.227578][T24569] sit1: entered allmulticast mode [ 1446.234681][T24564] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 1446.360870][T24576] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1446.444905][T24576] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1447.060322][ T5877] usb 1-1: USB disconnect, device number 118 [ 1447.215826][T24585] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1447.236295][T24585] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1447.681415][T24593] syzkaller0: entered promiscuous mode [ 1447.704520][T24593] syzkaller0: entered allmulticast mode [ 1448.285270][T24604] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4970'. [ 1448.294886][T24604] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4970'. [ 1449.512395][T13735] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 1449.675684][T13735] usb 7-1: no configurations [ 1449.680549][T13735] usb 7-1: can't read configurations, error -22 [ 1449.817566][T13735] usb 7-1: new high-speed USB device number 8 using dummy_hcd [ 1449.976919][T13735] usb 7-1: no configurations [ 1449.981606][T13735] usb 7-1: can't read configurations, error -22 [ 1449.988799][T13735] usb usb7-port1: attempt power cycle [ 1450.327787][T13735] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 1450.364001][T13735] usb 7-1: no configurations [ 1450.368642][T13735] usb 7-1: can't read configurations, error -22 [ 1450.512515][T13735] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 1450.547607][T13735] usb 7-1: no configurations [ 1450.552838][T13735] usb 7-1: can't read configurations, error -22 [ 1450.567595][T13735] usb usb7-port1: unable to enumerate USB device [ 1450.934126][T24628] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1450.944583][T24628] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1451.239565][T24642] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1451.260027][T24642] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1451.561897][T24651] tipc: Can't bind to reserved service type 0 [ 1451.947232][T24659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1451.980371][T24659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1451.992463][T10841] usb 1-1: new high-speed USB device number 119 using dummy_hcd [ 1452.164760][T10841] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1452.182385][T10841] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1452.192392][T10841] usb 1-1: Product: syz [ 1452.197350][T10841] usb 1-1: Manufacturer: syz [ 1452.202209][T10841] usb 1-1: SerialNumber: syz [ 1452.478649][T24663] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.508941][T24663] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.518324][T24663] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.529867][T24663] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.539417][T24663] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.548738][T24663] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.568355][T24663] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.592548][T24663] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.616601][T24663] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.668372][T24663] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4990'. [ 1452.822378][T10841] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1452.846976][T10841] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1452.881112][T10841] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1452.958570][T10841] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -32 [ 1453.141537][T24675] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1453.157394][T24675] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1455.122462][T10841] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 1455.292726][T10841] usb 7-1: Using ep0 maxpacket: 8 [ 1455.307723][T10841] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 1455.318562][T10841] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1455.328876][T10841] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1455.340364][T10841] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1455.350878][T10841] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1455.411333][T10841] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1455.467617][T10841] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1455.693418][ T5877] usb 1-1: USB disconnect, device number 119 [ 1455.781627][T24731] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1455.827733][T24731] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1456.412191][ C0] wdm_int_callback: 15514 callbacks suppressed [ 1456.412220][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.425073][ C0] wdm_int_callback: 15514 callbacks suppressed [ 1456.425088][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1456.438465][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.445158][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1456.452852][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.459562][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1456.465992][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.472698][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1456.479125][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.485813][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1456.492604][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.499321][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1456.505827][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.512503][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1456.518865][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.525562][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1456.532136][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.538849][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1456.545299][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1456.551978][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1457.392423][ T5877] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 1457.547866][ T5877] usb 2-1: Using ep0 maxpacket: 32 [ 1457.556673][ T5877] usb 2-1: config 0 has an invalid interface number: 132 but max is 0 [ 1457.572834][ T5877] usb 2-1: config 0 has no interface number 0 [ 1457.579434][ T5877] usb 2-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1457.711230][T10841] usb 7-1: usb_control_msg returned -71 [ 1457.722640][T10841] usbtmc 7-1:16.0: can't read capabilities [ 1457.752079][T10841] usb 7-1: USB disconnect, device number 11 [ 1457.755389][ T5877] usb 2-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1457.768405][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1457.777512][ T5877] usb 2-1: Product: syz [ 1457.879170][ T5877] usb 2-1: Manufacturer: syz [ 1457.884067][ T5877] usb 2-1: SerialNumber: syz [ 1457.891690][ T5877] usb 2-1: config 0 descriptor?? [ 1457.911310][ T5877] em28xx 2-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1457.927467][ T5877] em28xx 2-1:0.132: Video interface 132 found: [ 1457.938112][T24787] FAULT_INJECTION: forcing a failure. [ 1457.938112][T24787] name failslab, interval 1, probability 0, space 0, times 0 [ 1457.947556][T24788] FAULT_INJECTION: forcing a failure. [ 1457.947556][T24788] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1457.951884][T24787] CPU: 0 UID: 0 PID: 24787 Comm: syz.5.5008 Not tainted syzkaller #0 PREEMPT(full) [ 1457.951907][T24787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1457.951917][T24787] Call Trace: [ 1457.951925][T24787] [ 1457.951933][T24787] dump_stack_lvl+0x189/0x250 [ 1457.951959][T24787] ? irqentry_exit+0x74/0x90 [ 1457.951979][T24787] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1457.952010][T24787] ? dump_stack+0x9/0x20 [ 1457.952033][T24787] should_fail_ex+0x414/0x560 [ 1457.952060][T24787] should_failslab+0xa8/0x100 [ 1457.952085][T24787] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1457.952107][T24787] ? skb_clone+0x212/0x3a0 [ 1457.952132][T24787] skb_clone+0x212/0x3a0 [ 1457.952150][T24787] ? nfnetlink_rcv+0x486/0x2520 [ 1457.952175][T24787] nfnetlink_rcv+0x4b4/0x2520 [ 1457.952201][T24787] ? __dev_queue_xmit+0x1d79/0x3b50 [ 1457.952231][T24787] ? __dev_queue_xmit+0x27b/0x3b50 [ 1457.952263][T24787] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1457.952301][T24787] ? ref_tracker_free+0x63a/0x7d0 [ 1457.952317][T24787] ? __asan_memcpy+0x40/0x70 [ 1457.952335][T24787] ? __pfx_ref_tracker_free+0x10/0x10 [ 1457.952366][T24787] ? skb_clone+0x246/0x3a0 [ 1457.952389][T24787] ? __netlink_deliver_tap+0x807/0x850 [ 1457.952407][T24787] ? netlink_deliver_tap+0x2e/0x1b0 [ 1457.952440][T24787] netlink_unicast+0x82c/0x9e0 [ 1457.952472][T24787] ? __pfx_netlink_unicast+0x10/0x10 [ 1457.952496][T24787] ? netlink_sendmsg+0x642/0xb30 [ 1457.952512][T24787] ? skb_put+0x11b/0x210 [ 1457.952534][T24787] netlink_sendmsg+0x805/0xb30 [ 1457.952560][T24787] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1457.952581][T24787] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1457.952600][T24787] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1457.952617][T24787] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1457.952636][T24787] __sock_sendmsg+0x21c/0x270 [ 1457.952663][T24787] ____sys_sendmsg+0x505/0x830 [ 1457.952688][T24787] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1457.952716][T24787] ? import_iovec+0x74/0xa0 [ 1457.952740][T24787] ___sys_sendmsg+0x21f/0x2a0 [ 1457.952762][T24787] ? __pfx____sys_sendmsg+0x10/0x10 [ 1457.952826][T24787] ? __x64_sys_sendmsg+0x180/0x260 [ 1457.952852][T24787] __x64_sys_sendmsg+0x19b/0x260 [ 1457.952874][T24787] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1457.952903][T24787] ? __pfx_ksys_write+0x10/0x10 [ 1457.952922][T24787] ? rcu_is_watching+0x15/0xb0 [ 1457.952945][T24787] ? do_syscall_64+0xbe/0x3b0 [ 1457.952967][T24787] do_syscall_64+0xfa/0x3b0 [ 1457.952983][T24787] ? lockdep_hardirqs_on+0x9c/0x150 [ 1457.953000][T24787] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.953016][T24787] ? clear_bhb_loop+0x60/0xb0 [ 1457.953036][T24787] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1457.953052][T24787] RIP: 0033:0x7f3b7d38eec9 [ 1457.953068][T24787] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1457.953082][T24787] RSP: 002b:00007f3b7e2b9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1457.953100][T24787] RAX: ffffffffffffffda RBX: 00007f3b7d5e5fa0 RCX: 00007f3b7d38eec9 [ 1457.953112][T24787] RDX: 0000000000000040 RSI: 0000200000009b40 RDI: 0000000000000003 [ 1457.953123][T24787] RBP: 00007f3b7e2b9090 R08: 0000000000000000 R09: 0000000000000000 [ 1457.953135][T24787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1457.953145][T24787] R13: 00007f3b7d5e6038 R14: 00007f3b7d5e5fa0 R15: 00007f3b7d70fa28 [ 1457.953173][T24787] [ 1458.308834][T24788] CPU: 1 UID: 0 PID: 24788 Comm: syz.6.5009 Not tainted syzkaller #0 PREEMPT(full) [ 1458.308859][T24788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1458.308870][T24788] Call Trace: [ 1458.308878][T24788] [ 1458.308886][T24788] dump_stack_lvl+0x189/0x250 [ 1458.308910][T24788] ? __pfx____ratelimit+0x10/0x10 [ 1458.308930][T24788] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1458.308950][T24788] ? __pfx__printk+0x10/0x10 [ 1458.308972][T24788] ? __might_fault+0xb0/0x130 [ 1458.309007][T24788] should_fail_ex+0x414/0x560 [ 1458.309037][T24788] _copy_from_user+0x2d/0xb0 [ 1458.309059][T24788] move_addr_to_kernel+0x7e/0x160 [ 1458.309083][T24788] io_submit_sqes+0x914/0x1d30 [ 1458.309136][T24788] __se_sys_io_uring_enter+0x2df/0x2b20 [ 1458.309181][T24788] ? ksys_write+0x1cb/0x250 [ 1458.309207][T24788] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1458.309227][T24788] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 1458.309247][T24788] ? __pfx_vfs_write+0x10/0x10 [ 1458.309270][T24788] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1458.309290][T24788] ? __fget_files+0x3a0/0x420 [ 1458.309312][T24788] ? fput+0xa0/0xd0 [ 1458.309329][T24788] ? ksys_write+0x22a/0x250 [ 1458.309351][T24788] ? __pfx_ksys_write+0x10/0x10 [ 1458.309370][T24788] ? rcu_is_watching+0x15/0xb0 [ 1458.309392][T24788] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1458.309419][T24788] do_syscall_64+0xfa/0x3b0 [ 1458.309437][T24788] ? lockdep_hardirqs_on+0x9c/0x150 [ 1458.309455][T24788] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1458.309469][T24788] ? clear_bhb_loop+0x60/0xb0 [ 1458.309482][T24788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1458.309492][T24788] RIP: 0033:0x7f38db98eec9 [ 1458.309502][T24788] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1458.309510][T24788] RSP: 002b:00007f38dc7e9038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1458.309524][T24788] RAX: ffffffffffffffda RBX: 00007f38dbbe6090 RCX: 00007f38db98eec9 [ 1458.309541][T24788] RDX: 0000000000000000 RSI: 0000000000003516 RDI: 0000000000000008 [ 1458.309553][T24788] RBP: 00007f38dc7e9090 R08: 0000000000000000 R09: 0000000000000000 [ 1458.309564][T24788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1458.309575][T24788] R13: 00007f38dbbe6128 R14: 00007f38dbbe6090 R15: 00007f38dbd0fa28 [ 1458.309606][T24788] [ 1458.311020][T24790] __nla_validate_parse: 45 callbacks suppressed [ 1458.311039][T24790] netlink: 84 bytes leftover after parsing attributes in process `syz.2.5007'. [ 1458.580047][T24791] fuse: Bad value for 'fd' [ 1458.589200][ T5877] em28xx 2-1:0.132: chip ID is em2884 [ 1459.186735][T24809] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5014'. [ 1459.225394][ T5877] em28xx 2-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=0) [ 1459.240142][T24809] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5014'. [ 1459.251273][ T5877] em28xx 2-1:0.132: board has no eeprom [ 1459.257033][T24809] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5014'. [ 1459.274137][T24809] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5014'. [ 1459.286274][T24809] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5014'. [ 1459.299525][T24809] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5014'. [ 1459.319497][T24809] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5014'. [ 1459.332641][T24809] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5014'. [ 1459.414950][T24809] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5014'. [ 1459.592517][ T5877] em28xx 2-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1459.600479][ T5877] em28xx 2-1:0.132: analog set to bulk mode. [ 1459.614345][ T5962] em28xx 2-1:0.132: Registering V4L2 extension [ 1459.641395][ T5877] usb 2-1: USB disconnect, device number 26 [ 1459.648248][ T5877] em28xx 2-1:0.132: Disconnecting em28xx [ 1459.680627][T24817] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1459.796274][T24817] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1459.831171][ T5962] em28xx 2-1:0.132: Config register raw data: 0xffffffed [ 1459.852472][ T5962] em28xx 2-1:0.132: AC97 chip type couldn't be determined [ 1459.859652][ T5962] em28xx 2-1:0.132: No AC97 audio processor [ 1459.896083][ T5962] usb 2-1: Decoder not found [ 1459.907252][ T5962] em28xx 2-1:0.132: failed to create media graph [ 1459.920759][ T5962] em28xx 2-1:0.132: V4L2 device video103 deregistered [ 1459.950018][ T5962] em28xx 2-1:0.132: Remote control support is not available for this card. [ 1459.971592][ T5877] em28xx 2-1:0.132: Closing input extension [ 1459.983850][ T5877] em28xx 2-1:0.132: Freeing device [ 1460.615990][ T5962] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 1460.772362][ T5962] usb 7-1: Using ep0 maxpacket: 16 [ 1460.783257][ T5962] usb 7-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1460.792521][ T5877] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 1460.800287][ T5962] usb 7-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1460.809058][ T5962] usb 7-1: Product: syz [ 1460.813770][ T5962] usb 7-1: Manufacturer: syz [ 1460.818353][ T5962] usb 7-1: SerialNumber: syz [ 1460.824888][ T5962] usb 7-1: config 0 descriptor?? [ 1460.962353][ T5877] usb 2-1: Using ep0 maxpacket: 32 [ 1460.969149][ T5877] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1460.981008][ T5877] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1460.992475][ T5877] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1461.007632][ T5877] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1461.019207][ T5877] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1461.031187][ T5877] usb 2-1: config 0 descriptor?? [ 1461.051921][T24827] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1461.081381][T11215] usb 7-1: USB disconnect, device number 12 [ 1461.088556][ T5877] hub 2-1:0.0: USB hub found [ 1461.242456][T24846] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1461.252201][T24846] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1461.319701][ T5877] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 1461.336308][ T5877] usbhid 2-1:0.0: can't add hid device: -71 [ 1461.342495][ T5877] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1461.373637][ T5877] usb 2-1: USB disconnect, device number 27 [ 1462.566442][T24869] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1462.600174][T24863] fuse: Bad value for 'fd' [ 1462.608312][T24869] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1462.677419][T24867] fuse: Bad value for 'fd' [ 1463.282382][T13735] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 1463.434828][T13735] usb 7-1: Using ep0 maxpacket: 32 [ 1463.441363][T13735] usb 7-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1463.451212][T13735] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1463.465026][T13735] usb 7-1: config 0 descriptor?? [ 1463.474466][T13735] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1464.024719][T24883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1464.055585][T24883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1464.157992][T24889] input: syz1 as /devices/virtual/input/input69 [ 1464.222333][ T5877] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 1464.374155][ T5877] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 1464.386801][ T5877] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1464.397506][ T5877] usb 2-1: config 0 descriptor?? [ 1464.405257][ T5877] cp210x 2-1:0.0: cp210x converter detected [ 1464.424051][T24892] __nla_validate_parse: 50 callbacks suppressed [ 1464.424073][T24892] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5038'. [ 1464.686582][ T919] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 1464.831725][ T5877] cp210x 2-1:0.0: failed to get vendor val 0x370c size 13: -121 [ 1464.840791][ T5877] cp210x 2-1:0.0: GPIO initialisation failed: -121 [ 1464.844687][ T919] usb 1-1: device descriptor read/64, error -71 [ 1464.850304][ T5877] usb 2-1: cp210x converter now attached to ttyUSB0 [ 1464.886406][T13735] gspca_vc032x: reg_w err -71 [ 1464.891213][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.898655][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.906333][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.911807][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.918582][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.924944][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.930302][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.937097][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.943412][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.948810][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.955523][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.960961][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.969072][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.976872][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.982464][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.987900][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1464.995903][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1465.001324][T13735] gspca_vc032x: I2c Bus Busy Wait 00 [ 1465.006930][T13735] gspca_vc032x: Unknown sensor... [ 1465.012126][T13735] vc032x 7-1:0.0: probe with driver vc032x failed with error -22 [ 1465.024821][T13735] usb 7-1: USB disconnect, device number 13 [ 1465.102784][ T919] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 1465.209754][T24898] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5040'. [ 1465.242670][ T919] usb 1-1: device descriptor read/64, error -71 [ 1465.362568][ T919] usb usb1-port1: attempt power cycle [ 1465.406862][T24900] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1465.467128][T24900] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1465.480656][ C0] wdm_int_callback: 5450 callbacks suppressed [ 1465.480683][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.493426][ C0] wdm_int_callback: 5450 callbacks suppressed [ 1465.493442][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.506207][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.512900][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.519312][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.525979][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.532405][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.539087][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.545467][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.552162][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.559188][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.565860][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.572960][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.579628][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.586008][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.592672][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.599014][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.605681][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.612049][ C0] cdc_mbim 6-1:1.0: nonzero urb status received: -71 [ 1465.618736][ C0] cdc_mbim 6-1:1.0: wdm_int_callback - 0 bytes [ 1465.722972][ T919] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 1465.788897][ T919] usb 1-1: device descriptor read/8, error -71 [ 1465.892323][ T44] usb 7-1: new low-speed USB device number 14 using dummy_hcd [ 1466.042477][ T919] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 1466.055208][ T44] usb 7-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1466.066649][ T44] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1466.078718][ T44] usb 7-1: config 0 descriptor?? [ 1466.092616][ T919] usb 1-1: device descriptor read/8, error -71 [ 1466.202771][ T919] usb usb1-port1: unable to enumerate USB device [ 1466.300087][ T44] asix 7-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 1466.878847][ T919] usb 2-1: USB disconnect, device number 28 [ 1466.889838][ T919] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 1466.900589][ T919] cp210x 2-1:0.0: device disconnected [ 1467.446508][T10841] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1467.604904][T10841] usb 2-1: Using ep0 maxpacket: 16 [ 1467.613126][T10841] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1467.627210][T10841] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1467.636431][T10841] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1467.651880][T10841] usb 2-1: config 0 descriptor?? [ 1467.702511][ T5877] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 1467.722422][T24903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1467.734860][T24903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1467.878939][ T5877] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1467.907175][ T5877] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1467.925166][ T5877] usb 1-1: Product: syz [ 1467.929682][ T5877] usb 1-1: Manufacturer: syz [ 1467.934701][ T5877] usb 1-1: SerialNumber: syz [ 1467.952771][ T44] asix 7-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0012: -71 [ 1467.977942][ T44] asix 7-1:0.0: probe with driver asix failed with error -71 [ 1467.996297][ T44] usb 7-1: USB disconnect, device number 14 [ 1468.104580][T10841] mcp2221 0003:04D8:00DD.0042: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 1468.610325][T24925] input: syz1 as /devices/virtual/input/input70 [ 1468.801704][ T5877] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1468.846942][ T5877] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1468.861569][ T5877] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1468.880837][ T5877] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -32 [ 1468.961101][ T5877] usb 2-1: USB disconnect, device number 29 [ 1469.007546][ T44] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 1469.209656][ T44] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1469.226324][ T44] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1469.237415][ T44] usb 7-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1469.248255][ T44] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1469.262760][ T44] usb 7-1: config 0 descriptor?? [ 1469.681520][T24941] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5052'. [ 1469.872372][T24942] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1469.891378][T24942] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1469.964798][ T44] usbhid 7-1:0.0: can't add hid device: -71 [ 1469.972550][ T44] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1469.998085][ T44] usb 7-1: USB disconnect, device number 15 [ 1470.677401][ T44] usb 1-1: USB disconnect, device number 124 [ 1470.776783][T24951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1470.851533][T24951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1470.862361][ T1212] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 1471.024861][ T1212] usb 7-1: Using ep0 maxpacket: 16 [ 1471.031452][ T1212] usb 7-1: config index 0 descriptor too short (expected 1316, got 36) [ 1471.040124][ T1212] usb 7-1: config 0 has an invalid interface number: 157 but max is -1 [ 1471.048688][ T1212] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1471.057857][ T1212] usb 7-1: config 0 has no interface number 0 [ 1471.064542][ T1212] usb 7-1: config 0 interface 157 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 16 [ 1471.074656][ T1212] usb 7-1: config 0 interface 157 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1471.084616][ T1212] usb 7-1: config 0 interface 157 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1471.096421][ T1212] usb 7-1: New USB device found, idVendor=0483, idProduct=3746, bcdDevice=94.86 [ 1471.106233][ T1212] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1471.114472][ T1212] usb 7-1: Product: syz [ 1471.118667][ T1212] usb 7-1: Manufacturer: syz [ 1471.123808][ T1212] usb 7-1: SerialNumber: syz [ 1471.130203][ T1212] usb 7-1: config 0 descriptor?? [ 1471.139080][T24947] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 1471.423902][T24959] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1471.443186][T24959] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1471.531658][ T1212] ftdi_sio 7-1:0.157: FTDI USB Serial Device converter detected [ 1471.540672][ T1212] ftdi_sio ttyUSB0: unknown device type: 0x9486 [ 1471.561821][ T1212] usb 7-1: USB disconnect, device number 16 [ 1471.578768][ T1212] ftdi_sio 7-1:0.157: device disconnected [ 1471.663530][T24964] input: syz1 as /devices/virtual/input/input71 [ 1471.732342][ T919] usb 2-1: new full-speed USB device number 30 using dummy_hcd [ 1471.916181][ T919] usb 2-1: not running at top speed; connect to a high speed hub [ 1471.925030][ T919] usb 2-1: config 1 has an invalid interface number: 254 but max is 3 [ 1471.936057][ T919] usb 2-1: config 1 has an invalid interface number: 6 but max is 3 [ 1471.945738][ T919] usb 2-1: config 1 has an invalid interface number: 93 but max is 3 [ 1471.954118][ T919] usb 2-1: config 1 has an invalid interface number: 179 but max is 3 [ 1471.962997][ T919] usb 2-1: config 1 has 5 interfaces, different from the descriptor's value: 4 [ 1471.972038][ T919] usb 2-1: config 1 has no interface number 0 [ 1471.978213][ T919] usb 2-1: config 1 has no interface number 2 [ 1471.984384][ T919] usb 2-1: config 1 has no interface number 3 [ 1471.990449][ T919] usb 2-1: config 1 has no interface number 4 [ 1471.996686][ T919] usb 2-1: config 1 interface 254 altsetting 3 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 1472.009841][ T919] usb 2-1: config 1 interface 6 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1472.022943][ T919] usb 2-1: config 1 interface 179 altsetting 6 has an invalid descriptor for endpoint zero, skipping [ 1472.033916][ T919] usb 2-1: config 1 interface 254 has no altsetting 0 [ 1472.040716][ T919] usb 2-1: config 1 interface 6 has no altsetting 0 [ 1472.047483][ T919] usb 2-1: config 1 interface 93 has no altsetting 0 [ 1472.054411][ T919] usb 2-1: config 1 interface 1 has no altsetting 0 [ 1472.061778][ T919] usb 2-1: config 1 interface 179 has no altsetting 0 [ 1472.070906][ T919] usb 2-1: New USB device found, idVendor=05d8, idProduct=810c, bcdDevice=36.ed [ 1472.096785][ T919] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1472.105242][ T919] usb 2-1: Product: 㐁 [ 1472.109427][ T919] usb 2-1: Manufacturer: 掳㚶拾㘄덁㳃떯㱫砕Ḙ둪恁㱖侾䥦ꛘ폠샄똗 [ 1472.141065][ T919] usb 2-1: SerialNumber: 㬸۫쁸谐葭㺵㔣튵곉좃⯘뀘겦ᦼ跻鏁퀞荋歊ퟰ齹鎥܌ச髢흋盥⋗䒼೸䒑饊鲰챜䰔櫴匳Ꮃꐇ빎윹ᛲ耶ꞅ飓疋掁ೄ崙残幦泟蒢兲缷Ϣ⣈髁㈥荃峅 [ 1472.224403][T24972] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5060'. [ 1472.511676][T24961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1472.532340][ T1212] usb 7-1: new full-speed USB device number 17 using dummy_hcd [ 1472.597456][T24961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1472.662412][ T1212] usb 7-1: device descriptor read/64, error -71 [ 1472.704246][T24961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1472.735939][T24961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1472.809275][T24961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1472.865760][T24961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1472.912392][ T1212] usb 7-1: new full-speed USB device number 18 using dummy_hcd [ 1472.981238][ T919] dvb-usb: found a 'Artec T14 - USB2.0 DVB-T' in warm state. [ 1472.991196][ T919] dvb-usb: bulk message failed: -8 (3/0) [ 1472.999222][ T919] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 1473.008180][ T919] dvbdev: DVB: registering new adapter (Artec T14 - USB2.0 DVB-T) [ 1473.016169][ T919] usb 2-1: media controller created [ 1473.023442][ T919] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1473.037495][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.042384][ T1212] usb 7-1: device descriptor read/64, error -71 [ 1473.043650][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.055307][ T919] dvb-usb: no frontend was attached by 'Artec T14 - USB2.0 DVB-T' [ 1473.065906][ T919] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input72 [ 1473.078917][ T919] dvb-usb: schedule remote query interval to 150 msecs. [ 1473.086550][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully initialized and connected. [ 1473.098331][ T919] dvb-usb: found a 'Artec T14 - USB2.0 DVB-T' in warm state. [ 1473.105856][ T919] dvb-usb: bulk message failed: -8 (3/0) [ 1473.114790][ T919] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 1473.124432][ T919] dvbdev: DVB: registering new adapter (Artec T14 - USB2.0 DVB-T) [ 1473.132393][ T919] usb 2-1: media controller created [ 1473.139454][ T919] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1473.151206][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.152885][ T1212] usb usb7-port1: attempt power cycle [ 1473.158696][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.168044][ T919] dvb-usb: no frontend was attached by 'Artec T14 - USB2.0 DVB-T' [ 1473.178559][ T919] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input73 [ 1473.192476][ T919] dvb-usb: schedule remote query interval to 150 msecs. [ 1473.199445][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully initialized and connected. [ 1473.211482][ T919] dvb-usb: found a 'Artec T14 - USB2.0 DVB-T' in warm state. [ 1473.218993][ T919] dvb-usb: bulk message failed: -8 (3/0) [ 1473.227599][ T919] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 1473.236663][ T919] dvbdev: DVB: registering new adapter (Artec T14 - USB2.0 DVB-T) [ 1473.245423][ T44] dvb-usb: bulk message failed: -8 (1/0) [ 1473.251154][ T44] dvb-usb: error while querying for an remote control event. [ 1473.258632][ T919] usb 2-1: media controller created [ 1473.266587][ T919] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1473.282962][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.289018][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.302396][ T919] dvb-usb: no frontend was attached by 'Artec T14 - USB2.0 DVB-T' [ 1473.315426][ T919] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input74 [ 1473.329968][ T919] dvb-usb: schedule remote query interval to 150 msecs. [ 1473.337016][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully initialized and connected. [ 1473.348500][ T919] dvb-usb: found a 'Artec T14 - USB2.0 DVB-T' in warm state. [ 1473.356197][ T44] dvb-usb: bulk message failed: -8 (1/0) [ 1473.361921][ T919] dvb-usb: bulk message failed: -8 (3/0) [ 1473.367833][ T44] dvb-usb: error while querying for an remote control event. [ 1473.380838][ T919] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 1473.393223][ T919] dvbdev: DVB: registering new adapter (Artec T14 - USB2.0 DVB-T) [ 1473.401185][ T919] usb 2-1: media controller created [ 1473.409676][ T919] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1473.418190][ T44] dvb-usb: bulk message failed: -8 (1/0) [ 1473.423870][ T44] dvb-usb: error while querying for an remote control event. [ 1473.437543][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.443665][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.449467][ T919] dvb-usb: no frontend was attached by 'Artec T14 - USB2.0 DVB-T' [ 1473.460111][ T919] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input75 [ 1473.474053][ T919] dvb-usb: schedule remote query interval to 150 msecs. [ 1473.481017][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully initialized and connected. [ 1473.493410][ T919] dvb-usb: found a 'Artec T14 - USB2.0 DVB-T' in warm state. [ 1473.501513][ T919] dvb-usb: bulk message failed: -8 (3/0) [ 1473.502517][ T1212] usb 7-1: new full-speed USB device number 19 using dummy_hcd [ 1473.507388][ T44] dvb-usb: bulk message failed: -8 (1/0) [ 1473.523819][ T44] dvb-usb: error while querying for an remote control event. [ 1473.532486][ T919] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 1473.542164][ T919] dvbdev: DVB: registering new adapter (Artec T14 - USB2.0 DVB-T) [ 1473.545036][ T1212] usb 7-1: device descriptor read/8, error -71 [ 1473.550185][ T44] dvb-usb: bulk message failed: -8 (1/0) [ 1473.561890][ T919] usb 2-1: media controller created [ 1473.567239][ T44] dvb-usb: error while querying for an remote control event. [ 1473.576779][ T919] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1473.588698][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.594494][ T44] dvb-usb: bulk message failed: -8 (1/0) [ 1473.600848][ T919] dvb-usb: bulk message failed: -8 (6/0) [ 1473.606699][ T44] dvb-usb: error while querying for an remote control event. [ 1473.614278][ T919] dvb-usb: no frontend was attached by 'Artec T14 - USB2.0 DVB-T' [ 1473.625483][ T919] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input76 [ 1473.636839][ T44] dvb-usb: bulk message failed: -8 (1/0) [ 1473.642543][ T44] dvb-usb: error while querying for an remote control event. [ 1473.651803][ T919] dvb-usb: schedule remote query interval to 150 msecs. [ 1473.658838][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully initialized and connected. [ 1473.671346][ T919] usb 2-1: USB disconnect, device number 30 [ 1473.733706][ T44] dvb-usb: bulk message failed: -19 (1/0) [ 1473.739493][ T44] dvb-usb: error while querying for an remote control event. [ 1473.754160][T13735] dvb-usb: bulk message failed: -19 (1/0) [ 1473.759931][T13735] dvb-usb: error while querying for an remote control event. [ 1473.792377][ T1212] usb 7-1: new full-speed USB device number 20 using dummy_hcd [ 1473.802710][ T44] dvb-usb: bulk message failed: -19 (1/0) [ 1473.808481][ T44] dvb-usb: error while querying for an remote control event. [ 1473.816638][T10841] dvb-usb: bulk message failed: -19 (1/0) [ 1473.846297][T10841] dvb-usb: error while querying for an remote control event. [ 1473.892044][ T1212] usb 7-1: device descriptor read/8, error -71 [ 1473.942373][T10841] dvb-usb: bulk message failed: -19 (1/0) [ 1473.948150][T10841] dvb-usb: error while querying for an remote control event. [ 1473.982361][T10841] dvb-usb: bulk message failed: -19 (1/0) [ 1473.988220][T10841] dvb-usb: error while querying for an remote control event. [ 1474.016267][ T1212] usb usb7-port1: unable to enumerate USB device [ 1474.023147][T10841] dvb-usb: bulk message failed: -19 (1/0) [ 1474.029025][T10841] dvb-usb: error while querying for an remote control event. [ 1474.036598][ T44] dvb-usb: bulk message failed: -19 (1/0) [ 1474.043911][ T44] dvb-usb: error while querying for an remote control event. [ 1474.062655][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully deinitialized and disconnected. [ 1474.113268][ T44] dvb-usb: bulk message failed: -19 (1/0) [ 1474.133522][ T44] dvb-usb: error while querying for an remote control event. [ 1474.167750][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully deinitialized and disconnected. [ 1474.212118][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully deinitialized and disconnected. [ 1474.221868][ T44] dvb-usb: bulk message failed: -19 (1/0) [ 1474.227702][ T44] dvb-usb: error while querying for an remote control event. [ 1474.236118][T10841] dvb-usb: bulk message failed: -19 (1/0) [ 1474.243969][T10841] dvb-usb: error while querying for an remote control event. [ 1474.280603][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully deinitialized and disconnected. [ 1474.305937][ T919] dvb-usb: Artec T14 - USB2.0 DVB-T successfully deinitialized and disconnected. [ 1474.666817][T24996] sit1: entered allmulticast mode [ 1474.859684][T25005] input: syz1 as /devices/virtual/input/input77 [ 1474.982535][T25008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1474.991153][T25008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1475.281795][T25018] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5074'. [ 1475.425674][T25016] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5073'. [ 1475.438063][T25016] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1475.450022][T25016] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1475.705086][ T919] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 1475.865685][ T919] usb 7-1: Using ep0 maxpacket: 32 [ 1475.872550][ T919] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1475.884203][ T919] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1475.903580][ T919] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1475.916405][ T919] usb 7-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1475.927705][ T919] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1475.945378][ T919] usb 7-1: config 0 descriptor?? [ 1475.951103][T25018] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1475.964052][ T919] hub 7-1:0.0: USB hub found [ 1476.084870][T25025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1476.118515][T25025] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1476.204394][ T919] hub 7-1:0.0: 2 ports detected [ 1476.611827][ T919] hub 7-1:0.0: set hub depth failed [ 1476.624283][ T919] usb 7-1: USB disconnect, device number 21 [ 1477.084257][ T919] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 1477.247762][ T919] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1477.259466][ T919] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1477.269465][ T919] usb 2-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1477.279082][ T919] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1477.307395][ T919] usb 2-1: config 0 descriptor?? [ 1477.484569][T25035] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5079'. [ 1478.370454][ T919] hid-led 0003:27B8:01ED.0043: hidraw0: USB HID v0.00 Device [HID 27b8:01ed] on usb-dummy_hcd.1-1/input0 [ 1478.417413][ T919] hid-led 0003:27B8:01ED.0043: ThingM blink(1) initialized [ 1478.653149][T25042] sit1: entered allmulticast mode [ 1478.792837][T25045] input: syz1 as /devices/virtual/input/input78 [ 1478.843773][ T919] usb 2-1: USB disconnect, device number 31 [ 1479.324200][T10841] usb 7-1: new full-speed USB device number 22 using dummy_hcd [ 1479.496929][T10841] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1479.507413][T10841] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1479.528129][T10841] usb 7-1: New USB device found, idVendor=1bc7, idProduct=1040, bcdDevice=b5.b1 [ 1479.539082][T10841] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1479.549129][T10841] usb 7-1: Product: syz [ 1479.553684][T10841] usb 7-1: Manufacturer: syz [ 1479.558287][T10841] usb 7-1: SerialNumber: syz [ 1479.567792][T10841] usb 7-1: config 0 descriptor?? [ 1479.574869][T10841] option 7-1:0.0: GSM modem (1-port) converter detected [ 1480.038119][T25065] program syz.1.5088 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1480.732363][T11215] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1480.887386][T11215] usb 2-1: Using ep0 maxpacket: 16 [ 1480.900275][T11215] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1480.914796][T11215] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1480.926235][T11215] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1480.950211][T11215] usb 2-1: config 0 descriptor?? [ 1481.043364][T25074] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.094331][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.105227][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.134063][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.154097][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.207078][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.237321][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.281082][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.319034][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.330856][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5090'. [ 1481.379940][T11215] mcp2221 0003:04D8:00DD.0044: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 1481.799393][T11215] usb 2-1: USB disconnect, device number 32 [ 1481.931674][T25079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1481.996497][T11215] usb 7-1: USB disconnect, device number 22 [ 1482.004171][T11215] option 7-1:0.0: device disconnected [ 1482.041269][T25079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1482.289067][T25089] ======================================================= [ 1482.289067][T25089] WARNING: The mand mount option has been deprecated and [ 1482.289067][T25089] and is ignored by this kernel. Remove the mand [ 1482.289067][T25089] option from the mount to silence this warning. [ 1482.289067][T25089] ======================================================= [ 1482.323996][ C1] vkms_vblank_simulate: vblank timer overrun [ 1482.452514][ T1212] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 1482.610162][ T1212] usb 1-1: Using ep0 maxpacket: 32 [ 1482.695267][ T1212] usb 1-1: config 0 has an invalid interface number: 132 but max is 0 [ 1482.720239][ T1212] usb 1-1: config 0 has no interface number 0 [ 1482.744995][ T1212] usb 1-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1482.953160][T10841] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 1482.966476][ T1212] usb 1-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1483.005121][ T1212] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1483.026037][ T1212] usb 1-1: Product: syz [ 1483.034710][ T1212] usb 1-1: Manufacturer: syz [ 1483.046334][ T1212] usb 1-1: SerialNumber: syz [ 1483.065214][ T1212] usb 1-1: config 0 descriptor?? [ 1483.122681][T10841] usb 7-1: Using ep0 maxpacket: 8 [ 1483.148775][T10841] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 1483.151912][ T1212] em28xx 1-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1483.182696][T10841] usb 7-1: config 0 has no interface number 0 [ 1483.188958][ T1212] em28xx 1-1:0.132: Video interface 132 found: [ 1483.189111][T10841] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1483.212738][T10841] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1483.228707][T10841] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1483.241966][T10841] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1483.256035][T10841] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1483.266199][T10841] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1483.285544][T10841] usb 7-1: config 0 descriptor?? [ 1483.301991][T10841] ldusb 7-1:0.55: LD USB Device #1 now attached to major 180 minor 1 [ 1483.552344][ T1212] em28xx 1-1:0.132: unknown em28xx chip ID (0) [ 1484.017928][ T1212] em28xx 1-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=0) [ 1484.031887][ T1212] em28xx 1-1:0.132: board has no eeprom [ 1484.334995][ T1212] em28xx 1-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1484.346666][ T1212] em28xx 1-1:0.132: analog set to bulk mode. [ 1484.353151][ T5962] em28xx 1-1:0.132: Registering V4L2 extension [ 1484.522465][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.528827][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1485.130828][ T5962] em28xx 1-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 1485.131110][T13735] usb 1-1: USB disconnect, device number 125 [ 1485.147573][ T5962] em28xx 1-1:0.132: failed to trigger read from i2c address 0x48 (error=-19) [ 1485.147807][T13735] em28xx 1-1:0.132: Disconnecting em28xx [ 1485.237202][ T5962] em28xx 1-1:0.132: Config register raw data: 0xffffffed [ 1485.246026][ T5962] em28xx 1-1:0.132: AC97 chip type couldn't be determined [ 1485.255501][ T5962] em28xx 1-1:0.132: No AC97 audio processor [ 1485.299605][ T5962] usb 1-1: Decoder not found [ 1485.305969][ T5962] em28xx 1-1:0.132: failed to create media graph [ 1485.316404][ T5962] em28xx 1-1:0.132: V4L2 device video103 deregistered [ 1485.331602][T25126] ================================================================== [ 1485.339711][T25126] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 1485.347071][T25126] Read of size 8 at addr ffff88807346c740 by task v4l_id/25126 [ 1485.354607][T25126] [ 1485.356921][T25126] CPU: 1 UID: 0 PID: 25126 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1485.356936][T25126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1485.356943][T25126] Call Trace: [ 1485.356948][T25126] [ 1485.356953][T25126] dump_stack_lvl+0x189/0x250 [ 1485.356968][T25126] ? rcu_is_watching+0x15/0xb0 [ 1485.356979][T25126] ? __kasan_check_byte+0x12/0x40 [ 1485.356993][T25126] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1485.357004][T25126] ? rcu_is_watching+0x15/0xb0 [ 1485.357013][T25126] ? lock_release+0x4b/0x3e0 [ 1485.357027][T25126] ? __virt_addr_valid+0x1c8/0x5c0 [ 1485.357040][T25126] ? __virt_addr_valid+0x4a5/0x5c0 [ 1485.357052][T25126] print_report+0xca/0x240 [ 1485.357062][T25126] ? v4l2_fh_open+0xc7/0x430 [ 1485.357072][T25126] kasan_report+0x118/0x150 [ 1485.357086][T25126] ? v4l2_fh_open+0xc7/0x430 [ 1485.357096][T25126] v4l2_fh_open+0xc7/0x430 [ 1485.357107][T25126] em28xx_v4l2_open+0x157/0x9a0 [ 1485.357124][T25126] v4l2_open+0x20f/0x360 [ 1485.357136][T25126] chrdev_open+0x4c9/0x5e0 [ 1485.357145][T25126] ? __pfx_chrdev_open+0x10/0x10 [ 1485.357154][T25126] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1485.357171][T25126] ? __pfx_chrdev_open+0x10/0x10 [ 1485.357178][T25126] do_dentry_open+0x950/0x13f0 [ 1485.357192][T25126] vfs_open+0x3b/0x340 [ 1485.357200][T25126] ? path_openat+0x2ecd/0x3830 [ 1485.357213][T25126] path_openat+0x2ee5/0x3830 [ 1485.357224][T25126] ? arch_stack_walk+0xfc/0x150 [ 1485.357239][T25126] ? stack_depot_save_flags+0x40/0x860 [ 1485.357256][T25126] ? __pfx_path_openat+0x10/0x10 [ 1485.357267][T25126] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.357281][T25126] do_filp_open+0x1fa/0x410 [ 1485.357291][T25126] ? __lock_acquire+0xab9/0xd20 [ 1485.357305][T25126] ? __pfx_do_filp_open+0x10/0x10 [ 1485.357321][T25126] ? _raw_spin_unlock+0x28/0x50 [ 1485.357335][T25126] ? alloc_fd+0x64c/0x6c0 [ 1485.357351][T25126] do_sys_openat2+0x121/0x1c0 [ 1485.357361][T25126] ? __pfx_do_sys_openat2+0x10/0x10 [ 1485.357372][T25126] ? exc_page_fault+0x76/0xf0 [ 1485.357382][T25126] ? do_user_addr_fault+0xc8a/0x1390 [ 1485.357398][T25126] __x64_sys_openat+0x138/0x170 [ 1485.357409][T25126] do_syscall_64+0xfa/0x3b0 [ 1485.357420][T25126] ? lockdep_hardirqs_on+0x9c/0x150 [ 1485.357430][T25126] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.357444][T25126] ? clear_bhb_loop+0x60/0xb0 [ 1485.357455][T25126] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.357466][T25126] RIP: 0033:0x7f895c4a7407 [ 1485.357477][T25126] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1485.357486][T25126] RSP: 002b:00007ffd4c04b550 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1485.357497][T25126] RAX: ffffffffffffffda RBX: 00007f895cbf7880 RCX: 00007f895c4a7407 [ 1485.357504][T25126] RDX: 0000000000000000 RSI: 00007ffd4c04bf1a RDI: ffffffffffffff9c [ 1485.357511][T25126] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1485.357517][T25126] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1485.357523][T25126] R13: 00007ffd4c04b7a0 R14: 00007f895cd5e000 R15: 0000563bcd6734d8 [ 1485.357534][T25126] [ 1485.357538][T25126] [ 1485.665122][T25126] Allocated by task 5962: [ 1485.669433][T25126] kasan_save_track+0x3e/0x80 [ 1485.674100][T25126] __kasan_kmalloc+0x93/0xb0 [ 1485.678675][T25126] __kmalloc_cache_noprof+0x230/0x3d0 [ 1485.684033][T25126] em28xx_v4l2_init+0x10b/0x2e70 [ 1485.688962][T25126] em28xx_init_extension+0x120/0x1c0 [ 1485.694234][T25126] process_scheduled_works+0xae1/0x17b0 [ 1485.699763][T25126] worker_thread+0x8a0/0xda0 [ 1485.704335][T25126] kthread+0x70e/0x8a0 [ 1485.708387][T25126] ret_from_fork+0x439/0x7d0 [ 1485.712956][T25126] ret_from_fork_asm+0x1a/0x30 [ 1485.717703][T25126] [ 1485.720027][T25126] Freed by task 5962: [ 1485.723983][T25126] kasan_save_track+0x3e/0x80 [ 1485.728644][T25126] kasan_save_free_info+0x46/0x50 [ 1485.733658][T25126] __kasan_slab_free+0x5b/0x80 [ 1485.738406][T25126] kfree+0x18e/0x440 [ 1485.742296][T25126] em28xx_v4l2_init+0x1683/0x2e70 [ 1485.747324][T25126] em28xx_init_extension+0x120/0x1c0 [ 1485.752655][T25126] process_scheduled_works+0xae1/0x17b0 [ 1485.758192][T25126] worker_thread+0x8a0/0xda0 [ 1485.762772][T25126] kthread+0x70e/0x8a0 [ 1485.766836][T25126] ret_from_fork+0x439/0x7d0 [ 1485.771416][T25126] ret_from_fork_asm+0x1a/0x30 [ 1485.776180][T25126] [ 1485.778497][T25126] The buggy address belongs to the object at ffff88807346c000 [ 1485.778497][T25126] which belongs to the cache kmalloc-8k of size 8192 [ 1485.792537][T25126] The buggy address is located 1856 bytes inside of [ 1485.792537][T25126] freed 8192-byte region [ffff88807346c000, ffff88807346e000) [ 1485.806505][T25126] [ 1485.808817][T25126] The buggy address belongs to the physical page: [ 1485.815221][T25126] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73468 [ 1485.823968][T25126] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1485.832464][T25126] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1485.840343][T25126] page_type: f5(slab) [ 1485.844308][T25126] raw: 00fff00000000040 ffff88801a442280 ffffea0001fe8400 dead000000000003 [ 1485.852878][T25126] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 1485.861454][T25126] head: 00fff00000000040 ffff88801a442280 ffffea0001fe8400 dead000000000003 [ 1485.870109][T25126] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 1485.878765][T25126] head: 00fff00000000003 ffffea0001cd1a01 00000000ffffffff 00000000ffffffff [ 1485.887418][T25126] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1485.896109][T25126] page dumped because: kasan: bad access detected [ 1485.902504][T25126] page_owner tracks the page as allocated [ 1485.908207][T25126] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP), pid 5534, tgid 5534 (dhcpcd), ts 1436797892229, free_ts 1436404600454 [ 1485.927726][T25126] post_alloc_hook+0x240/0x2a0 [ 1485.932488][T25126] get_page_from_freelist+0x21e4/0x22c0 [ 1485.938025][T25126] __alloc_frozen_pages_noprof+0x181/0x370 [ 1485.943938][T25126] alloc_pages_mpol+0x232/0x4a0 [ 1485.948797][T25126] allocate_slab+0x8a/0x370 [ 1485.953291][T25126] ___slab_alloc+0xbeb/0x1420 [ 1485.957955][T25126] __kvmalloc_node_noprof+0x429/0x5f0 [ 1485.963313][T25126] pfifo_fast_init+0x363/0x6b0 [ 1485.968067][T25126] qdisc_create_dflt+0x13b/0x4e0 [ 1485.972987][T25126] dev_activate+0x378/0x1150 [ 1485.977562][T25126] __dev_open+0x69c/0x880 [ 1485.981876][T25126] __dev_change_flags+0x1ea/0x6d0 [ 1485.986889][T25126] netif_change_flags+0x88/0x1a0 [ 1485.991812][T25126] dev_change_flags+0x130/0x260 [ 1485.996649][T25126] devinet_ioctl+0xbb4/0x1b50 [ 1486.001311][T25126] inet_ioctl+0x3c0/0x4c0 [ 1486.005630][T25126] page last free pid 15 tgid 15 stack trace: [ 1486.011606][T25126] __free_frozen_pages+0xbc4/0xd30 [ 1486.016706][T25126] skb_release_data+0x62d/0x7c0 [ 1486.021546][T25126] consume_skb+0x9e/0xf0 [ 1486.025774][T25126] usbnet_bh+0x3f7/0xd70 [ 1486.030014][T25126] process_scheduled_works+0xae1/0x17b0 [ 1486.035637][T25126] bh_worker+0x2b1/0x600 [ 1486.039864][T25126] tasklet_action+0xc/0x70 [ 1486.044263][T25126] handle_softirqs+0x283/0x870 [ 1486.049219][T25126] run_ksoftirqd+0x9b/0x100 [ 1486.053731][T25126] smpboot_thread_fn+0x53f/0xa60 [ 1486.058654][T25126] kthread+0x70e/0x8a0 [ 1486.062714][T25126] ret_from_fork+0x439/0x7d0 [ 1486.067294][T25126] ret_from_fork_asm+0x1a/0x30 [ 1486.072060][T25126] [ 1486.074371][T25126] Memory state around the buggy address: [ 1486.079984][T25126] ffff88807346c600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1486.088209][T25126] ffff88807346c680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1486.096253][T25126] >ffff88807346c700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1486.104293][T25126] ^ [ 1486.110429][T25126] ffff88807346c780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1486.118822][T25126] ffff88807346c800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1486.126864][T25126] ================================================================== [ 1486.134975][ C1] vkms_vblank_simulate: vblank timer overrun [ 1486.141761][ T5962] em28xx 1-1:0.132: Remote control support is not available for this card. [ 1486.181757][T13735] em28xx 1-1:0.132: Closing input extension [ 1486.193532][T25126] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1486.200756][T25126] CPU: 1 UID: 0 PID: 25126 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1486.209766][T25126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1486.219831][T25126] Call Trace: [ 1486.223110][T25126] [ 1486.226026][T25126] dump_stack_lvl+0x99/0x250 [ 1486.230605][T25126] ? __asan_memcpy+0x40/0x70 [ 1486.235192][T25126] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1486.240398][T25126] ? __pfx__printk+0x10/0x10 [ 1486.245006][T25126] vpanic+0x281/0x750 [ 1486.248975][T25126] ? preempt_schedule+0xae/0xc0 [ 1486.253810][T25126] ? __pfx_vpanic+0x10/0x10 [ 1486.258291][T25126] ? preempt_schedule_common+0x83/0xd0 [ 1486.263730][T25126] ? preempt_schedule+0xae/0xc0 [ 1486.268564][T25126] ? __pfx_preempt_schedule+0x10/0x10 [ 1486.273941][T25126] panic+0xb9/0xc0 [ 1486.277645][T25126] ? __pfx_panic+0x10/0x10 [ 1486.282048][T25126] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 1486.287942][T25126] ? v4l2_fh_open+0xc7/0x430 [ 1486.292519][T25126] check_panic_on_warn+0x89/0xb0 [ 1486.297449][T25126] ? v4l2_fh_open+0xc7/0x430 [ 1486.302024][T25126] end_report+0x78/0x160 [ 1486.306255][T25126] kasan_report+0x129/0x150 [ 1486.310746][T25126] ? v4l2_fh_open+0xc7/0x430 [ 1486.315322][T25126] v4l2_fh_open+0xc7/0x430 [ 1486.319726][T25126] em28xx_v4l2_open+0x157/0x9a0 [ 1486.324583][T25126] v4l2_open+0x20f/0x360 [ 1486.328823][T25126] chrdev_open+0x4c9/0x5e0 [ 1486.333223][T25126] ? __pfx_chrdev_open+0x10/0x10 [ 1486.338144][T25126] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1486.344467][T25126] ? __pfx_chrdev_open+0x10/0x10 [ 1486.349405][T25126] do_dentry_open+0x950/0x13f0 [ 1486.354160][T25126] vfs_open+0x3b/0x340 [ 1486.358211][T25126] ? path_openat+0x2ecd/0x3830 [ 1486.362985][T25126] path_openat+0x2ee5/0x3830 [ 1486.367566][T25126] ? arch_stack_walk+0xfc/0x150 [ 1486.372411][T25126] ? stack_depot_save_flags+0x40/0x860 [ 1486.377884][T25126] ? __pfx_path_openat+0x10/0x10 [ 1486.382808][T25126] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1486.388879][T25126] do_filp_open+0x1fa/0x410 [ 1486.393387][T25126] ? __lock_acquire+0xab9/0xd20 [ 1486.398228][T25126] ? __pfx_do_filp_open+0x10/0x10 [ 1486.403242][T25126] ? _raw_spin_unlock+0x28/0x50 [ 1486.408079][T25126] ? alloc_fd+0x64c/0x6c0 [ 1486.412400][T25126] do_sys_openat2+0x121/0x1c0 [ 1486.417065][T25126] ? __pfx_do_sys_openat2+0x10/0x10 [ 1486.422250][T25126] ? exc_page_fault+0x76/0xf0 [ 1486.426930][T25126] ? do_user_addr_fault+0xc8a/0x1390 [ 1486.432224][T25126] __x64_sys_openat+0x138/0x170 [ 1486.437086][T25126] do_syscall_64+0xfa/0x3b0 [ 1486.441579][T25126] ? lockdep_hardirqs_on+0x9c/0x150 [ 1486.446761][T25126] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1486.452846][T25126] ? clear_bhb_loop+0x60/0xb0 [ 1486.457532][T25126] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1486.463493][T25126] RIP: 0033:0x7f895c4a7407 [ 1486.467938][T25126] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1486.487553][T25126] RSP: 002b:00007ffd4c04b550 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1486.495960][T25126] RAX: ffffffffffffffda RBX: 00007f895cbf7880 RCX: 00007f895c4a7407 [ 1486.503927][T25126] RDX: 0000000000000000 RSI: 00007ffd4c04bf1a RDI: ffffffffffffff9c [ 1486.511889][T25126] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1486.519944][T25126] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1486.527905][T25126] R13: 00007ffd4c04b7a0 R14: 00007f895cd5e000 R15: 0000563bcd6734d8 [ 1486.535878][T25126] [ 1486.539038][T25126] Kernel Offset: disabled [ 1486.543347][T25126] Rebooting in 86400 seconds..