last executing test programs: 25m40.060217002s ago: executing program 4 (id=940): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000900)='/proc/keys\x00', 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x22042, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1000, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000200)={'bond0\x00', &(0x7f0000000640)=@ethtool_per_queue_op={0x4b, 0xf, [0x4, 0x8, 0xfffffff1, 0x8, 0x0, 0x1, 0x3e9, 0x5, 0x9, 0x6, 0x5, 0x6, 0x7ff, 0x4, 0x4, 0x3ff, 0x4, 0x8, 0x2, 0x4, 0x6, 0x4, 0x8, 0x1, 0xfffffa0c, 0x7, 0x8, 0x9be, 0x3, 0x3ff, 0x6, 0x14dc, 0x147, 0x400009, 0x1, 0x3, 0x4, 0x0, 0x9, 0x6, 0x7, 0x5, 0x0, 0xfffffffb, 0x8, 0x80000000, 0x9, 0x100, 0x5, 0x19dd, 0x7, 0x5, 0x0, 0x6, 0xf667, 0xfffffffc, 0x4007, 0x80000008, 0x7f, 0x6, 0xc8, 0x6, 0x0, 0xc3, 0x4, 0x10, 0xffffffa8, 0x1, 0x40000009, 0x9, 0x1, 0x83, 0x0, 0xcf, 0x10, 0x401, 0x7, 0x7, 0x2a, 0x71c9, 0x1, 0x321, 0xfffffeff, 0x7f, 0x66, 0x1c24, 0xff, 0x9, 0x4, 0x2, 0x3, 0xff, 0x100, 0x126, 0x1, 0x8, 0x40000000, 0xc, 0x4, 0x8, 0xffffffc0, 0x4, 0x10001, 0x5, 0x74a000, 0x44e27, 0x3ff, 0x0, 0x8356, 0x0, 0x6, 0x9b7, 0x1, 0x80000001, 0x82, 0xea, 0x6, 0x80000000, 0xff, 0x7, 0x0, 0x5, 0x10001, 0x8, 0x69e4, 0x80000001, 0xfffffff4, 0x100]}}) r4 = socket$inet_smc(0x2b, 0x1, 0x0) r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r6 = fcntl$dupfd(r5, 0x0, r5) write$sndseq(r6, &(0x7f0000000180)=[{0xff, 0x0, 0x0, 0x0, @tick=0x4, {}, {}, @result={0x1, 0x2}}, {0x0, 0x0, 0xff, 0x3, @tick=0xf27, {0x1}, {}, @addr={0x2a, 0x5}}], 0x38) readv(r6, &(0x7f0000000000)=[{&(0x7f0000001140)=""/136, 0x88}], 0x1) r7 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000000)={0x5, 0xfff, 0x8, 0x2, 0x5, 0x80000000, 0x5, 0x48a5}, &(0x7f0000000040)=0x20) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000e80)={'filter\x00', 0xb001, 0x4, 0x3b0, 0x0, 0x10c, 0x1f0, 0x2d0, 0x2d0, 0x2d0, 0x7fffffe, 0x0, {[{{@uncond, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010101, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2, 0x1}}}, {{@uncond, 0xbc, 0xe4, 0x0, {0x0, 0x1e03}}, @unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x46e, 0xfffc}}}, {{@uncond, 0xbc, 0xe0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0x31caf518}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3fc) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) writev(r5, &(0x7f0000000540)=[{&(0x7f00000000c0)='$T{', 0x3}, {&(0x7f0000000240)="3a77acfd5e3f5b9057ae6018a749450f789ba0177859fcba83592be5205aeed8b1f5e232e6a00bc47ec28687b917c513dc25d2c09e8389abf694a55a5520f963f3123c8ec23833669be46e6e925dedb89f9be55a05f02749c9f71a71c9217e0c92ae63c2dfcd48cc8bab594f7af56cfc756c6c54493e91bd4ab2e5def4c51a5fb5e1b2b537eb97a26be469fc04bbbe7837e3147a64040401d90dfdc2f56f64c7a1a990", 0xa3}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="ecdb4314493f26288f76d090af6c0d6fcaee411919b3961c30d5a2e07ec8b093bb3f8772764afd0b1229872237cc35b8cdff96c75f3e343920df7c350316d02bc3873865d9599df71df4e5248f9d9294e7c2572878a1a5b36a45e7547886bcaf3d653763290da5229e061084786c5b480ebc375e5d1b8fb7ffeeb5db2998c14647a90e187c1e1f46e1985f8a9f21f34c014abf50bf5928d1991d934f7d64d3e1e08df75915ea0620e08d3163713bd593021244c135", 0xb5}, {&(0x7f00000004c0)="19881bab55adf869ab46d72a8c31fc47c7b4855cc4de6869c46f66cbcaed7c8e0eab69ff229da231c0fddc2ba87042f8f622ac4d3f99b35796a4ebe3c41e69541d6c417d4cc11d4f1956f94cfc044ff5a19959", 0x53}, {0x0}], 0x6) setsockopt$inet6_tcp_int(r8, 0x6, 0x1b, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000940)={0x2020}, 0x2020) 25m36.401188396s ago: executing program 4 (id=956): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x43c3, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)=0xfffffffb) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)='\x00!', 0x2}], 0xa, 0x0, 0x0) 25m35.982840419s ago: executing program 4 (id=957): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=@gettaction={0x48, 0x32, 0x400, 0x70bd2a, 0x25cfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4000009}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f7}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040810) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_io_uring_setup(0x1110, &(0x7f0000000140)={0x0, 0x4, 0x400}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r8, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r8, &(0x7f0000000040)={0x50, 0x0, r9, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000003380)='system.posix_acl_access\x00', &(0x7f0000000540)=ANY=[@ANYRES32=0x0, @ANYBLOB="0400000000000000100005000000000020"], 0x2c, 0x0) syz_fuse_handle_req(r8, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000777a078afbd825c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000023000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000db2100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cc2351270000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r10, r8) writev(r6, &(0x7f0000001400)=[{&(0x7f0000001280)="189f", 0x2}], 0x1) splice(r5, 0x0, r7, 0x0, 0x4ffe2, 0x0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x4, 0x5, 0x8}, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000007100004000000000018004"]) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_FADVISE={0x18, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x40000}) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00'}) 25m35.120670696s ago: executing program 4 (id=962): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002280)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000440)='./file0\x00', 0x9) 25m33.725239371s ago: executing program 4 (id=970): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x2, 0x300) bind$packet(r0, &(0x7f0000000300)={0x11, 0x63dcbf62d8600606, 0x0, 0x1, 0x8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x32}}, 0x14) bind$packet(r1, &(0x7f0000000040)={0x11, 0x4}, 0x14) syz_emit_ethernet(0x11, &(0x7f0000000340)={@local, @empty, @void, {@llc={0x4, {@llc={0x42, 0x8e, "be"}}}}}, 0x0) 25m33.38891689s ago: executing program 4 (id=972): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x304}, "7817765dc5914c3d", "c0a9b92b592a8e91a6934cb6b7b18f7a7a6eaa9cbd8ef3b0fbc326100136e976", "58a190f0", "2a1e833e7af32011"}, 0x38) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000280)=@ccm_128={{0x304, 0x34}, "ee26d83c64bf3981", "a18592dc0168f8baf07e3fdf0cfd79b1", "3a17a2b9", "b4c1c6a5eabd2dab"}, 0x28) 25m33.007233627s ago: executing program 32 (id=972): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_256={{0x304}, "7817765dc5914c3d", "c0a9b92b592a8e91a6934cb6b7b18f7a7a6eaa9cbd8ef3b0fbc326100136e976", "58a190f0", "2a1e833e7af32011"}, 0x38) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000280)=@ccm_128={{0x304, 0x34}, "ee26d83c64bf3981", "a18592dc0168f8baf07e3fdf0cfd79b1", "3a17a2b9", "b4c1c6a5eabd2dab"}, 0x28) 12.591507206s ago: executing program 5 (id=4467): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fcfff9ff0000000000000000850000003600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_KEY(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010800000000030000000b00000008000300", @ANYRES32, @ANYBLOB="200050800500020000000000081a030001ac0f00090001007ee5d52ffd000000", @ANYRESOCT=r3], 0x3c}}, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r2, 0x80089419, &(0x7f0000000080)) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x7ffe, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x1fa7}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newtfilter={0x4c, 0x2c, 0xd27, 0x70bd24, 0x259fdbfc, {0x0, 0x0, 0x0, r12, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0x9, 0x5, 0xffffffff}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0x1, 0xb}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x2004c000) socket$nl_netfilter(0x10, 0x3, 0xc) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x24a40, 0x0) ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r14 = syz_open_procfs(0x0, &(0x7f0000000200)='ns\x00') getdents(r14, &(0x7f00000000c0)=""/35, 0x23) 11.524929596s ago: executing program 5 (id=4470): socket$inet_sctp(0x2, 0x5, 0x84) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904000001a7a00f00090582020002"], 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7ff, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0x0, 0x0, 0x34343459}}) sendto$inet6(r0, 0x0, 0x0, 0x20004041, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(0xffffffffffffffff, 0x80184132, &(0x7f0000000200)) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socket(0x10, 0x3, 0x0) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) shmctl$SHM_STAT(0x0, 0xd, 0x0) r4 = memfd_create(&(0x7f00000008c0)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x0) ftruncate(r4, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r4, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) sendfile(r4, r4, 0x0, 0x200001) r5 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x21041, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000000)=0xe) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000)=0x2000000, 0x0) futex(&(0x7f000000cffc)=0x2, 0x3, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x1, 0x1, 0x3, "9611e6d6ffc88885163200", 0x31303453}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_mreqsrc(r6, 0x0, 0xf, 0x0, &(0x7f0000000040)) 7.422168613s ago: executing program 5 (id=4481): socket$inet_sctp(0x2, 0x5, 0x84) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904000001a7a00f00090582020002"], 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7ff, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0x0, 0x0, 0x34343459}}) sendto$inet6(r0, 0x0, 0x0, 0x20004041, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(0xffffffffffffffff, 0x80184132, &(0x7f0000000200)) r2 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socket(0x10, 0x3, 0x0) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) shmctl$SHM_STAT(0x0, 0xd, 0x0) r4 = memfd_create(&(0x7f00000008c0)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x0) ftruncate(r4, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r4, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) sendfile(r4, r4, 0x0, 0x200001) r5 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x21041, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000000)=0xe) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000)=0x2000000, 0x0) futex(&(0x7f000000cffc)=0x2, 0x3, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x1, 0x1, 0x3, "9611e6d6ffc88885163200", 0x31303453}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0xf, 0x0, &(0x7f0000000040)) 7.105416286s ago: executing program 0 (id=4485): r0 = syz_usbip_server_init(0x1) syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000994bd740e50d5600b505000000010902"], 0x0) write$usbip_server(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="0000000300000001"], 0x35) (async) socket$nl_generic(0x10, 0x3, 0x10) 6.67573053s ago: executing program 1 (id=4488): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000180)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90e, 0xffffbfff, '\x00', @p_u32=&(0x7f0000000040)}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000100)=ANY=[@ANYBLOB="98000000", @ANYRES16=r2, @ANYBLOB="010000000000000000000c00000018000180140002007665746831"], 0x98}}, 0x0) 6.335266275s ago: executing program 1 (id=4490): r0 = fanotify_init(0x200, 0x40000) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000940)=0xffffffffffffffff) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r3, 0x7c81, 0x0) r4 = socket$kcm(0x2, 0x5, 0x84) unshare(0x2a020400) r5 = openat(0xffffffffffffff9c, 0x0, 0xa000, 0x1da) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x30, 0x0, 0x310) close(r5) setsockopt$sock_attach_bpf(r4, 0x84, 0x17, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000000740)=""/14, 0xfef9) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) fanotify_mark(r0, 0x101, 0x48001051, r7, 0x0) r8 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') preadv(r8, &(0x7f0000000880)=[{&(0x7f00000007c0)=""/133, 0x85}], 0x1, 0x3, 0x1) 5.182639508s ago: executing program 0 (id=4493): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x2000004, 0x31, 0xffffffffffffffff, 0x0) futex(&(0x7f00000002c0), 0x8c, 0x1, 0x0, &(0x7f00000000c0), 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) socket$packet(0x11, 0x3, 0x300) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7b1250b"], 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x3}}) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x5422) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r1, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r1, 0x5008, 0x0) ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f00000001c0)={0x7, 0x0, [{0xc0000001, 0x3ff, 0x2, 0xa10, 0x9}, {0x80000007, 0x0, 0x6a, 0x3, 0xfff}, {0x40000001, 0xfffffffc, 0x80, 0x7ff, 0xc}, {0x1, 0x1, 0x3, 0x5, 0x4}, {0x6, 0x1, 0x8, 0x7, 0x81}, {0xc0000000, 0x80, 0x0, 0x4, 0x3ff}, {0x0, 0x8, 0xaa, 0x7, 0x7}]}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) r3 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_DEL_MFC_PROXY(r4, 0x29, 0xd3, &(0x7f0000000040)={{0xa, 0x4e22, 0x1, @local, 0x5}, {0xa, 0x4e22, 0xffffff7f, @loopback, 0x1ff}, 0x1, {[0x42, 0x7, 0x6, 0xfffff333, 0xd6, 0x6, 0xffffffff, 0x5]}}, 0x5c) ioctl$DRM_IOCTL_AGP_ACQUIRE(r3, 0x6430) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000180)={0xffffffffffffffff, 0xfffffffffffffff9, 0x0, 0xb59}) 4.564192966s ago: executing program 1 (id=4494): socket$packet(0x11, 0x3, 0x300) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000200), 0x2, 0x9}}, 0x20) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000080)}, {&(0x7f0000000100)="16000000246837f73199aee6fdb9291b3091ec1a2d41d227975ad8ec309d59191b00867997f9c0efa9c9092a31cdbb98ea272787afda0af59a320709c3a59ef05c6f40ceafec53f48d6186e7d8409e35306221caf67b370d875eff3191932728e5ab6c9a3acf6ccee3e352c898f5744abaedfb53f92c37acb126bd143f3e9cdfcf25a8d6129fcc3a141c3f5ab6db772f87c787817a9b699dd60732d952716b103bc1e91ac5b1ed92f35389580994bb0df9bce07e7a80921888f984139f488d256a67fec0cbb5c4e93d5c151d97f676ab93b1efbd46f600dc964231e3257bf358448fddf894c0cdfa9115adbe5b19bc912fcbc8aac7719b649b1ff1267491da", 0xff}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802522897576ed115fa21b3d23a367844520b33f5b9aedc0245096765f4cb3b2ff4e54f39bd7346c2347875d75a931b17c6c424ddb4767e0e63cc7725a8fc4b1dbe7929b2f909cc5be8b09e63330341e6471dcac0f8b44693d01805a1467b71612260e2a273861b3697440a5f75497796bffcf79d62a4a50a6ed5ef2efe8c83374f2ecd08d8d628aa03b01a11caeb2bdecc0ab2abcecfa15627979d7c3f9dec5389fc6625e957f8075e23e636dd5514596189d568e14d33ae518e6e9978c6a36a74b49fdbd1260095c9abe447e618878039b75e305b1d2c9ddeb9e5cedb11802e0833739d8595d57d749c890c9290cca4aa96e6718747543796a187e54a66c2f71beefddf911a7a74b59c48ba642d5ecd4d415f48dfbde5baac8a4ba063c1b985d9f9f3180e8a1c8b2cf6a25c2ff17688cc858ac8b9c67960f09a1ca5f28f8e877159e00fe7fb10cca73b391508895e7e52c22f9b38d73dabd6ff7c55ebf4e1611daee8d52b4ceee49a6df7daeb81bf9d1c943a74c03d3dda52c5b99f3225c1b87074f5cef6187878bc5b665ec0561adcc9781280dd1c6592555d327afea78b21beeeb66a0af3eab3249245f41cdbca309d3fba5d4b345319dd0a26134c0c896f2c8d32fda28600013f6a4c95b4038faba70d6c480b360c55bdc0595f7ca636e85521ba505d894f9c5f0a90719bc9944f386ad7491422ff12f34a3c048708d51305a8cc5b2a502ac1575a14c75e9fb7219ede2f6d9c1b362230b6189e0d8cd8ccd11fd0325182c6e46c9977bf63aa02f7024aeb4389f989f5733a198b45e4329c4c1a538a009f216ad3ac09cac39547b4fd21a5d7146ea307ad9b9339f39d5161d17b59860a0aed38cd89d1b68c6438346d51a3a283074e34ee01d2eca527b1b3836ccdf7e807007152c79d14324e3d887c9551a9447527db4434810f5b0b73d855f32a0c89aa784e43f4c1657d408dd33f88aeae1e5186bbcc2a348b708e3cec9080e12ee3676beb5ee86a9b5cc4a3496c242b95a248906ed62f984b22373bdfd97515441f34e01006d8d1244aa88403f207cd8820ffe07634fc86d00f871c1e4c9e8fc1a00d295e36d98119599b62379cda10ada85efe7b50c5f38d8d010a2cd53db900939db1ffce14feffb7940d12842f4f2b507e1fa49e526752d1e3d80a0c2a75e870d85f77fd91fc46ac1b1288dd33338cdad154d6b80b5a925431868d62a3fb0036f28fe259a3f555f767526a9ea230c33843efc49ac3182a357845ea122d606ab22c9f937b2b905e02dd1cb07d380e3486be6167f00b6e6d90a3c1d6aee15da439a55542ce177e498998ba8ac69a848e63e4c7564e4dc04aad595fa1ab81275edafa0d352029c304200d2f2c5881cbf5a26b2141bdb117879cc11e7c13bd62f221ae1ac04dca3d8d58a13c130557ecf5f36184c7366d3852d0cbd6ca42f2a971d87c0bb204097af1a3abdab7b95d07fcdbf5f42607695dedcd26e30b8fc5cfd7b333a95f3ee69d5ba7911dadb1394285c437a0f26fc027737ba5ee7d63333f80acb59f1a7faf2ec3031c6533107502bffc92d8726a48ce00cdb5f1258d85ff8eb72bfb162e122022f1f3e8a72b41d2689d5228b1130fbc946384401f3bbe726314bb09d430333ad78de07b3cec5c18a4f4abb69507b6451ca4e610b8fc988c983426e0cc3b9d15393026eb75d3d08634b8a7495cef69aab83d27ea1b5b41f40b996dd10023d81f77d61192930ffc25cae1e149412322fcb0aa47bee3afc44ec3dda96c9294854e2cbaebfea6f9a90f0b3797d5f505824b4de964151569f881f87f9dd9d30a2a2f9ed01059a909cba157902903c77f2f3d056231e7c7483a3f35e04360e084f0d3f94a92c92c77b3f06479fbc417366d7fe87ddfcdfd86274f87a5f817b0f947924cbe2329f16f6b00c8a0ab96164f7b35fed38a388380af05c3600abc37a944c9e75a691728c26896ac3615297766f406aeb0f2fd147d68fad3fb3b032880280ebb4bf89252a36b0d9eb393daae72829b8da870b886676244897d5322b32703fcf138b66eedeb3024666a88fd99d8962f696ab7b34e19ced1bd27488aa2ffe5bfa11f8f9289bd8c052d4e88316cc33b0255ef1bfca4c17067d7f78175c56db481fe8dc6f73b1cbdf9d5823f115c9e03f2dfd07bc1ad88564d48b18cd9a30d83cbd5e6a3eedcb0ee86e5dd47f32820cb74dcf730b2052b31297b529e5e24f042335d13915e4048132fe1a101841e919c7870bb680eddead9a6111394bc12e274fbd88abaf2d254721c42e82abf4d1e319a631794ed6ce319ddd844ac5e9b1fc96dd9aaad42f2e087abe1b85430c4a00631970e3e74a6ed923f49e0df75685e044fae3fcea0af4dbfeebe0a9c2e73e8a89b89603a75f585e3ebba5453ae595da1469ea90ea3c9fb6a22411c56c58dfbf504caa629dbfc73ebbedc91669f2babf8b8215c525edf8feb366f104ffa9eb2bb79232660aece4730ef1ae8585c629ffe1390356a58e900da145b83ad177c7bb2d125e59d7ff4d3a8562efc620b4cf9b33c2305bbf1957e0f8b06f0fbe9c80db73b08fdd0be4a1ea4f91f52af47160040424aed8ac3c10251fb0b5d9be08247edf3dda5d1750d0597d60c8a0d9418a4e0c9325bb90f0886f9e5dda9e88ac1942ec1e53da0cf5ccad66b9cdfc2fdca784dd06a73713ef73785706d024873ddca5ccfcf0b91748a2c1fbd8c241934b5b473007b29d76aec5addf7b945a5f7abd6ddeccc8d0ccb26d69d4793b7224c27ba7bf45aac8a2be56086ab8c65ea69fdd593a01a29e2912378002d824bd98e6ed1c5dd5f33be529e640997f5f1bbde051fb2a669145966db4889bf32aa13777ac6c077c51bb8b2523954cea3adc307cfe53b8cbb00edf0c04c456392aea6613e8078a309dc538a6a24f80fc1b7f9fce3e3291ca6dab8090a634fcdb24e7a9de8aecd595b988f597cd623d148a8841b0a5203953166ea2e85316928f28dd2604d37c9ec80a49c0d91cbfe6d584b9b6a321b97bf99ae1d67985fd441976a828c97456003a7892c7c7f4a51bb49e3d3ea1e95ec29c89a", 0xfff}], 0x3) 4.31661922s ago: executing program 3 (id=4495): mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file3\x00', 0xc1c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793f10d10501200002000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000840)={0x44, &(0x7f0000000600)={0x0, 0x1, 0x6, "92b876422ba9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x1, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file3\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file7\x00', 0x0) r1 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000040)=0x10, 0x80000) getsockopt$TIPC_CONN_TIMEOUT(r1, 0x10f, 0x82, &(0x7f0000000080), &(0x7f0000000180)=0x4) renameat2(0xffffffffffffff9c, &(0x7f00000008c0)='./file4\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./file7\x00', 0x0) 4.315807404s ago: executing program 1 (id=4496): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=@gettaction={0x48, 0x32, 0x400, 0x70bd2a, 0x25cfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}, @action_gd=@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4000009}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f7}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040810) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_io_uring_setup(0x1110, &(0x7f0000000140)={0x0, 0x4, 0x400}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r9, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r9, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r9, &(0x7f0000000040)={0x50, 0x0, r10, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000003380)='system.posix_acl_access\x00', &(0x7f0000000540)=ANY=[@ANYRES32=0x0, @ANYBLOB="0400000000000000100005000000000020"], 0x2c, 0x0) syz_fuse_handle_req(r9, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000777a078afbd825c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000023000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000db2100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cc2351270000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r11, r9) writev(r7, &(0x7f0000001400)=[{&(0x7f0000001280)="189f", 0x2}], 0x1) splice(r6, 0x0, r8, 0x0, 0x4ffe2, 0x0) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x4, 0x5, 0x8}, 0x0) r12 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r12, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000000000007100004000000000018004"]) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, 0x0) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00'}) 3.830004624s ago: executing program 5 (id=4498): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="440000001a0001002bbd7000030000000a000000", @ANYRES32=0x0, @ANYBLOB="04000004140003000700000000000000000000000000000014000100fc00"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x40000) socket$inet_tcp(0x2, 0x1, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80080) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000080)) socket$inet(0x2, 0x2, 0x1) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_int(r3, 0x29, 0x3e, &(0x7f0000000400)=0x9, 0x4) socket$can_j1939(0x1d, 0x2, 0x7) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$UI_GET_SYSNAME(0xffffffffffffffff, 0x8040552c, 0x0) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x4ee59ce4, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bond0\x00', 0x0}) setsockopt$packet_int(r6, 0x107, 0x14, &(0x7f0000000180)=0x2, 0x4) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000000)=0x3da, 0x4) openat$kvm(0xffffffffffffff9c, 0x0, 0x3, 0x0) sendto$packet(r6, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000040)) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000440)=@filter={'filter\x00', 0x42, 0x4, 0x318, 0xffffffff, 0x0, 0x198, 0xb0, 0xffffffff, 0xffffffff, 0x280, 0x280, 0x280, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x3e020000, 0x70, 0xb0, 0x0, {0x88000000}}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x81, 0x1b, "609488447b1772126bbef3d9cd8587335ff0e9c159f99af1990d6027471a"}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {0x122}, [@common=@inet=@udplite={{0x30}, {[0x4e20, 0x4e22], [0x4e22, 0x4e23], 0x3}}, @common=@socket0={{0x20}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@osf={{0x50}, {'syz1\x00', 0x0, 0x1, 0x1, 0x2}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x3}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x378) 3.663058909s ago: executing program 2 (id=4499): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$UHID_INPUT(r0, &(0x7f0000010140)={0x8, {"7f9654d636ab18b7938a2804505c72e9994ca22404fc203334cc21ed3d6a776fd12d13f9602b2980f983c31a5d1e431db778099ce3af3fb20e1ee1f4fdb77cbb36154982a93c19825d6fd273ab1eb5bcd47adad50de8a6791486e482e29ecc94284921f33b941cfc1000c9781d9a828c5ec7a2c77b4e624a5aa0e9e39782bad733eda81ba47e1c6116e4170e6587dd6210a57abe91f1f80c4e31139d8b73fe35ac1f99ea82dd6aa9c9aa67de88ae3e141020e1a876bbc449d2d843aa7e6d90b948b7e28770e6ac71010c63f17e90fd20806a9f8d9f418ee3af74aac64b04a27c4f5e3626ca2da546c79d24acadd11e8d272a22fc54078fd5e64475993668980a9f95aff964dee674356af492b8377a759d8ccf1accb9a18ef7ad16f438dde69cd020d71552b0810688c882a26a22b23f4b35471b08b379193db1cd7934a4049ff1b00d9795cda6e73951641d5e2365c24facd5afd09ed1d096d758b4fef66fe1aa22395d67b7e1db623d4a60a7dc93893d6c4a91df79535a855868c5dc0033d5c428cd25b85c5deb6e81068553bc84cead4d1eba8aa57e2b354a6899e44acbd3834491219b3e231cd55d82f161774a689efe197cc193ac0124c67738a0a1d5f16a6768c2c2ba7386c8c95ca08c55117f344f5a2bca0d09e79ea3fc49491f2c7adc513c2779c1bf62b1a8643d23e9e8b2ae41d4a59f1b82b82e092b36eb851b8456da871b4057aec325a9d4cccafde61f2abc85e3cabeabb856f6ffbfe23d69219ec8fae6beb54abe7870dbae823d49806a967a1c7f252999804f106745f20490bb3347b59321dc69765567abcbd89de04d89622170005df5871ed0fb72345a11da074060d7d4ee2e437f71a45723fb6b02de56067e54f54c52d10f7874a13cbfb3bd65ce54f9d6719ea210e0cf79e4e2157736ec07ac5915682ab81bced665c1e72fab8d8cfe509de0f21fe374b957b379fd5918061e21c2e96985cc1354b2de859b0f1a463ab04683b1253eda671c2353b5c208aca652f5419ffc4949a7fa909b95653f42d97390c400b4a1c308b11e73e9a06d3b164d3361e75584d70e6bc61d570a7e0c7da330f643194c1893fcd6489fac605eead61b53dff18caf526ecccc9bbd9146bc3c3bb67677695e6fddaab081786e9084014e60f5c03ae5a9087726b05e17402cd2fbb80d773b8a41470b1f901a8c2b2d57450181f4fc5bc53c7cb3dc032b84567492607cb08832eca9f79da9210d197863e5db5a74a9823dc0cc8bd9f3a9b6ff5a7d15d4747a9b26e088f4fad96d81cd1214226b1c4585d418d593220fcbb9ad949266cc48163e3498b46ebcdf7b2b5ecfe67539a61ed9e39b02d5b35ac0d0e7fa830034ca2da8a7ddf04bcf2cee939994369feb77023e0e3de04b21db7a640a92c17748245005cd75a7deba4ff0e4c104a9db2d9a98ec8edb3562050a3bac5f322290e3d8b6fb21770ac436d4cb12b97fc8f76d7bb9eeed85663eb0626f1ad1719ee4b07f7de2c1d1a31c27c6879f4fa3dbdfb2bfc0898beabafbeca9f13050e6b2f6c432e423cd5cb6b8fa56fe32c3e50104e44462c0a5c69de6a7ac5ae3d9f07ceed64dbffa42e4663838bfcde92f0fcb895f3b93c59b0e48c09890dfc36436db56b708f6e7cbbd2a6305f573cee099dbcd263cb96d9fb69cbc3cb06d8f5e3789698a17e71d22b4665ff5447fcc17a31bb136c8bb4b984573bcaf1cb650198c1266e6ddfd42d44f9de02cb9d915c5334c550fac3fcee56790aeb09d81e7690a32d8b0cc477b23f15257820de227be1ffaec2f63f3266b8f5dd78947dcee355fe59bfb100e5244425532bb1d115acd211b8c16b0ec0aae00fca5d4511a05c3ff027a1cac56210a10d81c01b90e156cc7b33de0fac825dc516d398166096013e068db935483c93ba95da39b5ae4087d84479a4c4809f28f93790dc279637bd6f3dc441d315cf6bd7b0e3d92070a45baf4445ce063fd12690eb002f5ca068a256bc54100c99a02a346beca39072163c4b297d117f1ed9fef42e3dbc11d36a0a0db52e84461c6fbb4aad62cd6c8dc9ae6a3390a5e8773ac599e67436220c8d541a9039762bffaa7f490e31dddbc362fb4ff686cda905f3b02a1db76d4d570d970434921ca8a4765af6d5c8b881e1f4ffa7e2d9ef5f5511b94f88474674ec790bb5186c73446a227bf1ffd19b605733abd1bd41e421aeaf2ed4617088c7ceef85451225056435993e89e4bccd2c2e4b39af99feef11fea645eeb5cf9f77b1e19a72d3efb613100969b84302789714bca65bcbc96762b4012a5700c62aed706433b9f142b7302442b6a9958b0e28e8b1cfa9eeb4ac0d71f497b23babf9f0221dcb658d9f4db5d45bee30d2ad7c97d6a562e014a7701c15325ec5d42ab732b37714a77a95c03fb15bbfba6fade32bf50f985a1df362ca7216cc152907dd931acb58a63920f581e82b590c0d6a0033009f8e50c3263d3f58596b63d507cadbc809a6690561f74d0772bf92d04e06c47a350724b106f5e83f7e71c4b2a983bf5ad7d8684e7b8b5dc1273d0fa5879b8e61bde33d602bc8ff0913b6d32dcac366d568dc7cf82bbfc405cbe418a2644c26592b32ca1a632fc95123efb784cfb6953a94ebeccd24fba389a0e56b043df07d9a2dd38a1196e5e55576b25f85cb96f6560802a4a58b7a6857e8454faa2c880bf32d464562b2bdc5f0df22b663f2c01fc944f1cfd1908f617f8295a5440bb79ae178ea46a95baeea48322105146ac3ed2de7d3796ddddcc848a8ecf4a00dd055733b4f59211f5a40deea44e74b3bc57953b26ed61e6fd67889edfe8d0902385e37666aacec072735630ecc441c3cc6b09bb2f63aa4e332c6df728dc74078a83ce20454dfd616d116270666ddc09c5fea2e8442bc43455d0257fac92f3780061178f9420bf8e463f29896c12383dbb9a81bc5c87376e647c8a7986cb514fb9696d9c0a8d303c5c4b5b7c5f601c01fa19323e02f675c371bc44fbc1ac5704d41a89a2a4ccec6ac8440c532f07da25aa2dce6a5d2ebe694eb4017d178b221213bfe2a01d9cfe689bd190776bca6c032f446eb8862587a7826e35f3f691763212eee6af2e49bbeb0a27e07c5714b74e373798c7bebce265f7ebef3a1ea64078cf1e8a9d433af32c53090c972ffedbadafb50b9a6e540abd84f8e938583ea725954be3b236c5d8aca7d486d21902a2902f25a7c02dbe83c39bd0b81513f9ef198c49d560e930ae224ff47f92e4851e1f7ab5bb406abcf6596569261e6b0c67bb3b854e9c6de60bfb60fcf29241ff237151310ecd19f8b2cfe764c1df1a2de9d840eca47aa169ba9a415901204ec31ccdfd76e908029ae34fb12dc286758c64fd6d42bc82b14e07e421f4b42b180cd6ef40cac8062928b4a420a4577f24295f54de9048ac9d34307bf93e463cea4967cf4880166f68ed1eb965db2e4fb9f5f0b1c695d621e427ccb9a3188073ee6fde729c6698346efa1c0ba643c1efd20858965511da750060d551c44c435a5f1603fae7357e0bc78e92aad3d88790ec2aa1a42d6fe7e0ffc57f3599e406db63be7dd32692df32ce33dee0a2becdb02d6e435e09de3d356497543db23f53da25643f9c585e275297800d8beed47f0e622f86fc25d2e87036fdceebfe7257cb6de0c02412d1c0758acfcd0862e99ad17a118f46f635a87477e8b825423d94ada35bf0b5444aa7d3de4bb7eec7ae5129fcc2cba651cc972f5500fc5161149d29f452962afb102a01ae76825cb4477460be0b85d75058595c27e9b7fae3492ec3925c671bee5f4ca534d5a294f783d6cc073c992139b61d21fd98297b04c0578dafd5f7ebcaf8d4d9185aea3d76e813421f4573b38c25093c015a65e44fb297f0f6ac2d02c4237b37a3bfca2406c5c95ae5812816bacad59ba7c6f72d7c644ff25b592ed1e89b276e05866c01a4ced7fc6dd9f190c20d420d7c8a1fe908833a24c5e5bd7a95a2a6fbf147fc4b29a179718166dd0fbae2fc6b8c8aac6194fa6baf0d3edc36b2316c56c441ba53e3e7aaaf0a1405566ff584f73a637b74dde9bcb4d41da2be6c9df5d533fbac54f5fb52a8a793757cfe19aa90048c6d07e3474136ae1be2455b0d0d02eb4b5961ba883209355c0dd2af4aad98e7b971e358a7d9b55fe17cd6095f257355d9b99e5ea52848f17b35a80792d9ed0fef6fe3eef9a324902409969823be20bbe0e8dba9c747cd1a14d3642d877b86271f3f0c322a142c4ff635b37d542c3265b5fe8589a732bb1a55010b930dd0196cd43ac3634c01b4a44c517197d03a3d89c67f5c09aab409e84c0af466bfbd0c96d240101a2542c66b4b4b8ef65b41b0079995c52cc9720d2c1d7c128c6f17a65cc798c1986cfbd8888460c54438edc4f91f3580391c8b57d9aee209a59a116c1c44775437e9c30e6d87e82ce84e28532b19441e32ab9aea22177bac9daad25a6c88395e9348d6780de630cddb266c411011175bdb6255a36535180818447d43ffba3758d311539fe9f6811fa470bf3767b4c2d4cdf37854c7ee28730bb1d39d5c0dfffcdbf353cca3e13079f3ae66b839c7dd36914022a0e75bca5b622f521420b73249ef47f03c1fb03ecf7557882afcaa7cf454a68ad237d4ce860bd6b1531c1cafe2cfb76bc4188271ef6bdfb304ee0e6932463a1909f03d6e8a27b5f137d6b342841d613863dfdf37d5ec3a98d667810fb6f82d67620bdefed8b3ff98420a6c7ee577c3ba68b95a20403608a7ba6526ec9e8662c6e15ab09b1a9019d4958af04cb2e4890ee6b1077fcaa5cc0817f388461b230fe631e75f18ab392a5ca5de4a024ca16dd05fcfdf92114e43a5c4a169d462ff0dba57deeaf5eaafd892f8ccbd72ac56471162e1416bca39859b4184ba0d1b3f7ec05db4ef4cf0142867fa9be328a0be8aa74c716aad9411008607980861f4f72e9bfa60195e2f939d3f6a44a6cec07dd376d1bccaa126686f313d5f7918ecd1215026982c82ed1922ef70e36e8ed59b2d5ceab3b4aad7e53049062dd5ba0e87f7005c3f4d2b788245cdc2f35ef2572bea5ea92dfad406ade6d5ad18be8eeb4c652e5277b244645c68c0c0f5a68d42e00d59b75941917b2cdf31fdf809f2078ca97fd5beba65b34e0621138ea0e94feb87166b2dac2232ebca575e5c0a4d565d9992f733bbfbe68a63d99ee93398604065d5517c33ed0e067bdb643e73102f16137afd7d4bf21e8065ea028c392a6dcefbe642dc3fb03a239d9c8b17023eacc8e19fea11c34a10644af1b786fc0f4504038c2ee59c1b353f3d7b9313df025b4b5874ca63ec164a3fe35bf390d266f53dcda6a8e190e63a56ffdf4f7c5c02aa22d376db06d4d2b96be5b331f897d1ecfd25c13a1c194c265dd95a5724a6435bc8138224d9db28b689b9cea5132cd19601dbc4a43e70c71e27e8fd0689d09484974e8a4605f8553735fffaf5654a087e323ca14e02b681b9bbe592bd6b719ae2e86bdf918b27c79d52dd334d1aa7ebc1bff76e97572faad092010a1022f7d33089049107a89c364ae7dd022d119e8f6ab795fd71d76a90e8202339401ff9e9918ea8c8e12f7b0ba10d9ebde5d1bc5988f2d07b34579d8c282628204f2978d8b0cf95dc41f3775a4053f833267c64b42336d7c850f2918ef0dd6d62e43fcc173254eb34748efd4754609ce25afd648ee5a8fc5c64346603f8258592d67b9613e8f7ac0def0958f13436581d729e0b3e062738eb06b2116abe837529690a614fc5d3f53b4d4602e5706000", 0x1000}}, 0x1006) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000080)=@bpf_lsm={0xd, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002d40)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000000203010200000000000000000000000009000200000000470200000008000340000000000800010001"], 0x30}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2000000002030500000000000000000000000000090002"], 0x20}}, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r0, 0x0) setxattr$incfs_metadata(0x0, &(0x7f0000000840), 0x0, 0x0, 0x1) 3.6615964s ago: executing program 1 (id=4500): syz_usb_connect$cdc_ecm(0x5, 0x5a, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) writev(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000040)={&(0x7f00002b9000/0x400000)=nil, &(0x7f00005cf000/0x4000)=nil, 0x400000, 0x2, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) socket$igmp6(0xa, 0x3, 0x2) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) syz_usb_connect$cdc_ncm(0x1, 0xdb, &(0x7f00000003c0)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc9, 0x2, 0x1, 0x8, 0x80, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "73d2f18908bb"}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0xffffffff, 0x3, 0x47, 0x5}, {0x6, 0x24, 0x1a, 0x0, 0x20}, [@mdlm_detail={0x54, 0x24, 0x13, 0x5, "9f0bba8b639375af261689bdbec24689239a4d7329c687b913b7a1dc619522d61c812c4bdd3b07e34bbe0aba8f69a1ee4d2366684f47a741e89fb9d67bd29039868021f2ad028520642b293679f9d709"}, @mbim={0xc, 0x24, 0x1b, 0x8, 0x1ff, 0x5, 0x81, 0x1, 0xd}, @network_terminal={0x7, 0x24, 0xa, 0xac, 0xe, 0x3, 0x5e}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x6, 0x2, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x7c, 0x80, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x2, 0x0, 0x3}}}}}}}]}}, &(0x7f0000000b40)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x200, 0x5, 0x8, 0xf2, 0x20, 0x4}, 0x16f, &(0x7f00000004c0)={0x5, 0xf, 0x16f, 0x3, [@generic={0x71, 0x10, 0x1, "2f76ddd94c4fa96f693c2b1b1aae1ea7cd2032b1fdab580ec51cb096ba998ce147686b7feade59076508b1d133a9e053e7b6e8428a1408d72a4bd43d715a9b1096c4cc32892efb7f0f4f43cc9af60f327fbadacb79f3a46a7e2c3752c2b7894157f559fdf105decfb10df6db0e2f"}, @generic={0x8c, 0x10, 0x2, "c83aa8a12b3d4ef655462019b4d0dfe33813e59afec4e74badb205bb5bf1aae47abba1f3429fb576a2bd664da924b443d2cd4c63ee7ced65a93b8a41a86b2be1a28bff49a583565aed9052e4ec1c1849c559f9dbf0028c1dd59e9db46a9c7f7b9ee9bd514165ec0a14715e657deb048f4b1f3d1ff572a997fd472158a50dbf1fccf86a726441e3d7d6"}, @generic={0x6d, 0x10, 0x3, "75402403fe8bad9baba1a501a74db5c2739df58722ebd8c1122dacbc8f0079af6582980e399f76e2362fae58c4aac995e9728281f8fe402b0917051abb3f6b638e444c9a113d61a9ba2618917afbbc49a474b747fc103a02cabde24e4f7aa0092d283cef7edce552d7b5"}]}, 0x9, [{0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x3001}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x100c}}, {0xe4, &(0x7f0000000680)=@string={0xe4, 0x3, "51878d13d2f4370acc2c9b19bcaf6f615c12c783f2e9616c8ffd6ecccea5b3bee0120e0fa3f11aed1aa820c7a4f083ffad6a08300ab525fc85259e381e6cd277949604345dc42c630fa66c635ff95e1f4ee6dec998b65365b0ce9c45cc00636b4663cae8958ea410a8e8856bd8e0f33b0e762a522e338b585be33ac775b0198eca86f86e2eb412323c319dac66d0445a11e7aab19954d5be8781b0f25ff702dd1bed47cbfbf317503f4e83f3c9ddd6abc2a1c8d51a26e43280078164a7470c987b4da0d12e3fac3e5adb1dbf4d247e1db7a7bfe278e1de9fa598c47ed93104f1dec9"}}, {0xe5, &(0x7f0000000780)=@string={0xe5, 0x3, "d262aa2fe2d0ebf0944cfbd3afcf4ad8d3a91768c7993f20ffa6bf100c22885de3d6c3927e9885842cf56590643d1ec9757c26c8acaf817ba1ea8b0e4693412d2d07860da14b89807e38d4b7798ecf296dafd232621e9a4a81f0b348d7e118ab000bb4c7ef454eb676b9e95f3fddfef069b205fcb38379ad2ffe311ef2ae33b5184cfb7b4f4b885c55152bde858989d144c61e8a42d1268918f05149f89e92220846c08c7652b65885baac28846d78599588961f2dff4bbd60725bac03ab7445d84ba5564f8f13619e5c968c30894d347d3c4a62f4512e5bc2af52ede7133a1b57dc17"}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0x418}}, {0xa3, &(0x7f00000008c0)=@string={0xa3, 0x3, "a0a3ee2231b2513d836cc42c9ee935229de5dc2a523370207e32ac3e948b17c9a767c2bd3a6c410f7ca88094c5aa3932675911721ffa9ff64797e5aa7055f97fa50956e117ee9b959ea03f6b60c81fa88ab9dbb2ddd083d3c713f59ca6d4b2bb4a89293e4289d85f2ed7cff9d9dee5a2cabfa749952409179e572b38f670c884f3bbc4b13565978b2fb907fe46fc31331408bc964e1fb962f2da0a42c6b511db10"}}, {0xc3, &(0x7f0000000980)=@string={0xc3, 0x3, "49f5fe473d68243b8277a476ebece7e62f3355253782f88154aec48fa72de4f9abe2242eec1bbfe1854999db693cf5f97e275e6a0b47512445baffdaf5a6e8ea2250f37ea802277f22be2e5edd65c2b53bd4446a6938daa51b1a9e93773a16df7a78a08fb8a05009484d4ed2df20bfde182182dd7dacd650838af85b6c5edb449367225b4e9a855f870be0f8a610412e351ee6276a225c9bc55f169ad919f384a1e602e012324a4183382ce46332ffd63cc014bb57e72b434100862a5e74775ca9"}}, {0x5f, &(0x7f0000000a80)=@string={0x5f, 0x3, "41d286925b1cebd46d2459c450c224cacd88ae2f7a9d68bfb25cbd48389efeea48039350e2d7928844b4fd1d105bae6d8eaa3a50fd8985e35eface3ade94c595500c4853083da7cb235c12d3757d7f111f9ec952a11126bd1f4904ca7d"}}, {0x4, &(0x7f0000000b00)=@lang_id={0x4}}]}) connect$inet(r3, &(0x7f0000000200)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@broadcast, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockname$inet(r5, &(0x7f0000000080)={0x2, 0x0, @empty}, &(0x7f00000000c0)=0x10) 3.501024374s ago: executing program 2 (id=4501): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x2}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r3, 0x325, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) socket(0x3f, 0x80805, 0x2) 3.339402431s ago: executing program 2 (id=4502): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r1, 0x29, 0x10, 0x0, &(0x7f0000000100)) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000400a8000600200005400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) 2.861884524s ago: executing program 2 (id=4503): set_robust_list(&(0x7f0000000140)={0x0, 0x7}, 0x18) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x20022, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1400}}, {@allow_other}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0x9}}], [{@obj_role={'obj_role', 0x3d, 'smaps\x00'}}, {@smackfsroot={'smackfsroot', 0x3d, '[])'}}, {@obj_user={'obj_user', 0x3d, 'v\xa6\xf5lj6,r\xaf\xe8\x10/\xecg\xed\xe3h\x80\xb8!y6w\xda\xdd\xb9\nR\xe8@\x99\xb9\x8a\x0fZ\t\x90\x8bp\x10\x84\x86t\x8a\xba\xc6\xfb\xd2\f\xef&\xad\xa8M\xe8\b\xb0#\xac)\x81\x1e\x8a\f\x11D\xe3l\x87\\\x15Hd~\\\x11\x95\xf8\xe6\xa7\xc3\xbc\x18+\x92\x92N\a\xa7\x7fN\x9bL\xf8\xebQs\x02\xf9\xadi\x8f\x0f\xff\x02n\x9d\x85\xea\x1a*\x1bI\xd8\x1c\xe8\x9bYS%\x1d\x10\x86\xa0\v\xea\xd9\x89\xda\xa7Wd\xa4Eu\x8csm\xa1.\xd1\xb2I\x1a\x0e\b$\x16\xb2\xfdA\x98\x16\xca\x83y\xf9\x1a\xe7\x06h\av\xa8\xd8\xceY\xc0\xe6v\xb5\xf5\x9d\xbe\xa58\xb42\xd8V$\xe6\xc8\x1c\xaf\x8e\xa1\xefa\xb1/\xee1=\xbfM\xeaw\f\xa2\x87\x1c(\x1a-\xeb\xfbV\xeb4\xd4C]\xc7{t\xf9\xd5`IZ\x03H\xd9\x86\xe12N\x1f\xd8{\xf5z@\xe0'}}]}}, 0x0, 0x0, &(0x7f0000002680)="fd508fa18445842471b5d649b480c83043746fb09599ba4db4215eb95b6e0455ba329630f86953d0a1211b2fc9f00426e205d6ab29a87313f74d30a451a4989f4f870bf5fb423b155c2b755655b3d16e0550db7e3edf13b299b5e8494b8337d503474cac388e8190bbea9958b2fa230fa91c44de28f077c0696b2efed67a46a53552ce8fb6323f260d7635eeb1384cea4f9284a768fa3156490f3e5295239391cacf48ad134497ca50f05e522c91ee1918a4c08da0266dc36031eccde383670589bae8b675606b3ba9ace9ae35c1dccf63277a90793299c581a618f9265f386a3cb6aaa4aa6e0bcef4e1b0dac3c66f2507301c222a26ad849035d71676a226dc01eba6dc3bc74dcb230327066c3b2e09a8eca10d7928fbc4ff0e47621fc92deadfc6ed56756671b004c170638ff1f5d7cb1663a52f68fd524150a5ea8ddd1a7961f69f1a4637c2d56abeaa75c8301b5cfdc1be95ad636310354b3155037d3205e7aa78e8c82043a859f648ffced134381d39b556d993b4a7a2fc9a05bf867760624e5e1c2a52e5978bf6224f452da915c74db75d9b836b0eb6ae2ce730abf5b9d2685b4de48bb542d8b9d52610446d1c0f10aae6b9d6cbac1b0265830c096da504fc0af19a3d4fe9173d1feb968e090fc6b9bff3aaa921d627b35f321fa0641391b90a1f4db5b1b196319cac11140f9c20448814aadeaf03499570526f55bf63f77f05f70857b8b1fda300c943a521226d737e893f2015f7212a1464391af0e4bb3bebf7e3ee54c53e1b11572bb7d62f729b96a017ced5ca65994bf88ea7e6e64aea7be98bfa199f389024935ef15505de17a6feec87be9dc953dd49ca0d5c18ad8d6242da3187d4c60b94e6d6cbad7579565b0e81836ef7c9b7b0a46ed226ee6ab36aadc02c6456c9be2b64f6c3ac596539f987c49e66dce4bb9a74f3deccf99dd242b3a0d799c73a2b04829b021afb0aaee6992df83d4ff7c00321aa481a71635bbce2753b668696b55a187d301817c248da33e112feb855463cf566dc343f6295487626ead02e4d5da2106b6c8ab4a6156072197e0cfac0d58332cfa4a5d96c69f19b5842a9fff3a8e79ce45e6ed708b70ca61d761a19e2ea70e44dabaaaadd5529f4e9aa5bbfa30bd94a2615ea530c35cb652a7db3d66b561438b7642112e51c40410e239cc9ac16740fbefecced17670da510397ea9d410a69b3684cd57f084f3e2c63953e2a1f1594984f81704054e9adb6bd6f587e30e6eb3b003b58d3c67add174f23372b93a1a409663aaf205ce589916bd7ea5a66ea8b941103c0e50055340be8674d09b8e3162a50f3ac9ba5b67ef1603e8ce126c8108ffcd0701a58296afb971a1974540c0d1f2df8037ab19b2957629e3098331ba199ef4917b6520650586c6a989ae7895812210f2fb8c19f2e4f991f886dd7945d2bb61255c1c016345fdcfc1e4b495fc94773dc1b5e91650aa7223eec502592bf4a5510473d313a9a6e36c60325701d6067357ba71639c49d39d0b808372023ef8ea8a297b0d1655191bdc2e4a070803254cc60142576d30eb1fbe27e65f1c68e4647d61c46c1c5f15fcc9eb7c4cd5daea4057a73bca6f0e3302db31740cb656936475ddd240f0467ec9bf9b34a2f5659a6b86332829d207c59f4abd990c0432a9e77c4af5dc80b8e3942f5cb736cb0206aa97161a26f60340c77d243d2478d7fb700127e7571d9e42219ed8afdaa65258d4ad4381580191183227686b4ff6e42fa318ceebea15c772c1da80acc7af95b1dc4b4ef6b45ea729a3eca38e4548ed895fef098fcecfcc93bb925832b2e2fbe0d5d65c2f0a039a913e3b1eb9a5b7b7a6dc91af2411a6f9c5e6d9aa857a5c71a925be68c6bcae468ab8e225b57893f73ce3a7971c07ab136fbd6d39cee01412a965743fcf916e896f9727d7ef1f8b3ad3caf2a06dab4809882dc9bd1b8f47b84d42d3556a7c78c37c8c17e3cd66bcba2895eb028491f464f8dd5e9bd480e6007ca94ec9e9080c5570fb7d95078ab62d1dfe8d991845691316e93c1369af8014f1a7b46a625de925c91d13d831c8dc66388b78ee079f19d9c9791a5fc52f7ec25cf487062c36f2f909181725bbbd495a035b893b7fe806d2050b669a21a56a367a934e0ad3b942afdd2f4080271a7068d7c1195a9ffc089f66b017bd3e1c76ab92989ab8c4ea36bfe397a4616b9e34eafbaedcd702b2a0b25402dfd264f96688a9855cc95a3ec33b6fefc9e22eb63476109eb639cee621b3cd51626bd42e0d151a4cd5a32436f98f0d00b6f4174725e7ce0a8ad15cd1f5b3863e590b8b851b1fb2118ba78a84fcf37bac1c8ec074ba3b5e9e4647297d251fa6e9ec493acf3cc32d7f4f5c6521dac801035ee10ed7bfdeea07d3cad6005d25704c2ac79d0f8edc79e4ffcff086765433d4102273851864796f0979d67fbcff2292088f2506a2c6a78f33b4b977ad4ddba5aa8f6c7b861126d2d15a461d7c71c3c9b44bc8b023e3c5898fb26452f0cb7150c8ffa626d8131ef7dd44e7537226430d8cf7b6f21d76136ed8348095ff4866e3d455e1b6f4711c94c08110e28879e0816f533c11f18cbea9f15d300343b9e47c6b4a225ade952cc15447b36f0535fd4a6f75aade4ce5535becaded2c8e4b57b9f4f0b01c1b977509566472f3028d4b9f59e9a6fa4306bca566badc5f6b86f2c25c12b1433cc2fc43c0b0b8307dc1d95457a1081ce563601c070c03d7c3b0d8890fa2c1cec778a6d4176c6311354a866f3c2cc223ea68445f47a35b4489ccbc972319e7284a61a66b846c7b3890ff82fd922bb1ba3e65a74cc473f54f42398b3975d6f6e2c0ca5c9292b745aedba52a39417f10527b03ba759bbb625272ed6c405fbbd67ede40e15323a7f8cd6606b4ad6332af263bc9bbd36140a1d0793b4357e5bdbf935955028c5ddfd49a6fc9c181439a855f785165a39aedb802dc9291f8a72a10856cf4e848e4714636d549c44a168df08c9159287bcc2701f61ee3653dca96901a4723a76cb58ba9f5ccf5fb6f76330d27c8ad2f10c21a4fa8b3e624ef01c487dae43eb4997c686d7c11bf89d195c00c17cce548590c1aee7c6cedb0a33786583d93f6011755d5f3258b90023bf4e3d0cfe4e2c57b783ba25da1424b3d635474e80ab973ce31a37451f8100a15a3af9e0248fc7232130ff0772c0bab9e8b529f6cf59d04ed93eef01b6fe9227882b0a632a5ee4aaceff7d92077dca8891b4f57cf31660a8d3f71bcbf77e3399708fcca645b5724e022132e6e229adbc4d0d7b8c78bb438c54c38bf5dd09bce4ce70bc4625a00e53540175681e74a6f6c11af160b719f2337fee10a34739f5b46436fdb3368327e77fb48c4360247998c49bcb3c8a0b05106bfb37b731d62f0f2358189ad915b9280a13621a83d33d8d0c558ea0199e442ef91d2fdd821936893423dd67967a3e7a6f7ad6bb036f63bf41cb71aeaadf8a79ca0c08af4b269372019e264a523e652eec442028170e34af72ba500ec6659eb1be0ea2ea5ebede2a4260a4eb7eec75ed9890d02dfd7ead2662854f2dac4444033e2cc406e3906600340936f85d056b90bfa97c6b4cc4872311b447e6dab4cc3611853090e6afd4ce5b6dd72413875c651319bb6458c347b5db0ef2515c601c3a94d9e4cbe6da4976df08291f62d3201fd39428801975cd54422dded852db69377ed86c531271284b0eb2102920e2b14bef260337d21e0e0ba011aeeba734985a11ff3162b3db7f5fdbff9e3ee925c84b2466084f4af61bad6aff514e20294e7ef5f75d09072ffb41c6b4bb76353ff88dddd4ad4d96bb38c10be53c2436e4feccc173ee341fafa4052810c44ac44d57473c3a2b7a9d817a701b6a9fcabc8ca53077a6d38ce766c53c02a38cdc89a9669ae363093e18c0fdde369aee533f6a361db42f68a149f61bb6727346cbebf0d9d4d4dd148ac5beaa9988999d1027bd26e0fe1edbc5245ce836715ec14624f71c83b9cbbb1ab50b53bb03a2bc57dfaab44f7f4a5ecae56964a1e0c4ef26d123934d7b83d1678ca194323c08fee8794312094eb295ef8ebb9d458f4c81093737762826fc7a63d0ecf9b9f0042f133f819b95430ae20ab615b77e8b7cc7e4a11982aa8b54d6139c5187cc5d477c16fa3cb21d0eb06be55907eada1e174576ee3e7c92806b5f7b7dbe16bc6cb81572802763686bee87e4778c6fad07f9a862b75ecc6e715dc74e68994868a0f35d4e45c95dc33273e16d40cc80adc833f568e075a4af43e9c1676024f3d1918143a66acdc86fb803309b575f4a31f2140274cd7de495888aea7c00adb55d71f421e19b766a93e0ed8c5fa16920ac27bee3ef4e8cdc03252e36f2c3690c5af0d15d87abc3b8ca926cb609c98325a61ba88e3b4445985cd04f785c49928fd7273ff29b7b2526c16a3f9ab507f2b1c83b72f14bedd4d3d1a2cb2de2a405debf09c7336bcdf37d97bd578d6113a5ab5527c728429a8be6beaf0e7f4ace0dcb828d8dce2454cd5417747010bcfdd5d866c48666eeea2a4c95a13730855b165c2d07fcff98425765fb7afcce71eca5f9257e7cd136654173529e6f265a0285981fcea6e54fa75fb8ee5db2b07b29d7e924584f2246741e1482394ac33c536c69fb9d197225922ee4aaa6a0e2d8975b76ba864d0788e6535b96345550c746901046173e483969bc3ab61966cefa1ba4b2dd6e463ee63ef2bda6ce0c5819e12bd94c16c789a06bf3cd53ba08ab2e5998950f0e7dadd721026e9c3d9baadecab7516c30fa0bcd957a534c7c38e0b2425559024a6dfbde8c450a0bae7eca6063a29c4a61c883290914b5d1e08e80424f9c3c501dcb0d5852da7727636872426c6750bef7d42ef7fd5ecb56090dd964a432afbc576ca4af47e80acfab55d7ad5e8218046fb36ed0220c238b584716bf30f86bdb7988f626dfc87f9ce7e5609f6ed66fe929ad9010c7f0e6c66d8079dc6fb9f4139c969b86692a0a343323c64cccb194467bd4561c73262b133295301c343e468812e29060641ec17516061c5086be17d372abcf97a049cbb774bc49d853b63d284fcf90ff98262abc03d0b52793641d63c0cb9484bf8cb5f02abf69a8e671c9a1701c206a1610a3013d7b601b435d6a3690522418a4e97216af6e26f22e14e95370437ec93b8a1febc756a4e16007b2db066c5f8754f6d8eae92ade6bc9945eb3f955a7c1a5e527eaf0277153ab4be72d216b52b92c1ba5099429723bc5920d7c57860f734d85ababa5715a22f73419d6ec4a081fd46eb964ff361adf90105a4387610f5ca4f5edd6467639cac51fb765a2ace4b41a4d602cf4754674451a3b87b041e03aacaebf85c4dccb37ea3b3c71a16abae043bd417ea443e0c422a51858ccd2b33036bfbbdc5a731a8b32806b4e75028ae2c7ca0a3c71e477f9068fd3965053e224d923ac5a269b164c5debd60bcf250f485f4114786eb44bdeff7c8875a2f3020892c40eef3aedebcd15406d66caf241c2990abb49b210540776ba07f073a7db0a6bf08fa67bf0357d824e5b0081b88cd885763029528650c08622e5211135528e7a12ada6f73144cf97a2d0658b72f613b56338d1e3ab45caec305af5aadf3273cb8aa7d2a53ef84cf3270e4e665343a4fd90c217d48633ac8850466444e8189464de6a57e3b9a67e822c5acc1c0a8a18716ad7de54d6b87956f16fc530b005479e9174c39566b7b2dba5c9236bef49dd896804b8839e417f7a99e783ee4609f2d84e7cecd48be14f463ab9881c3ba2d54c6a4b142371325") r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)) r5 = socket(0x10, 0x3, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r6, 0x0, 0xbc44) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7fff0000000000002800128009000100766c616e000000001800028006000100340200000c0002001f0000001e00000008000500", @ANYRES32=r4], 0x50}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001880)=ANY=[@ANYBLOB="500000001000210400000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa888e16000002800128009000100766c616e00000000180002800c0002000e0000000a000000060001000004000008000500", @ANYRES32=r9], 0x50}}, 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r10, {}, {0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) 2.665184841s ago: executing program 3 (id=4504): r0 = syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0405668, &(0x7f00000000c0)={0x1, 0x5, 0x1, "2ac0749f7a436a9c7d843197dba300", 0x30313953}) (fail_nth: 3) 2.346447962s ago: executing program 3 (id=4505): syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010102, @local}, {{0x4001, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x0, 0x1, 0x0, 0x0, {[@md5sig={0x13, 0x12, "473ecfd2106a00"}]}}}}}}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) syz_open_dev$sndctrl(0x0, 0x1, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) r1 = dup(r0) write$UHID_INPUT(r1, 0x0, 0x0) 2.156191612s ago: executing program 5 (id=4506): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4000) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)={0x2c, 0x19, 0xa, 0x401, 0x0, 0x2c, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x2c}}, 0x8004) 2.062431598s ago: executing program 5 (id=4507): pipe(&(0x7f00000002c0)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x101440, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x20000000, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) ppoll(&(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000280)=0xd) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000003b40)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, 0x0) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000380)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x8, '\x00', 0x0, r4, 0x1, 0x2, 0x1}, 0x50) ioctl$SNDCTL_DSP_SPEED(r3, 0xc0045002, &(0x7f0000000040)=0xdfe5) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000500)={0xa00, 0x18, 0xfa00, {0x100000000000000, 0x0}}, 0xfc36) unshare(0x60600) 1.913929983s ago: executing program 0 (id=4508): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0xfffffe01}, 0x8) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x80) ioctl$RTC_UIE_ON(r1, 0x7003) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f00000000c0)={'gre0\x00', 0x0, 0x8000, 0x8, 0xb, 0xfff, {{0x9, 0x4, 0x2, 0x19, 0x24, 0x67, 0x0, 0x4, 0x4, 0x0, @rand_addr=0x64010102, @rand_addr=0x64010102, {[@noop, @rr={0x7, 0xf, 0x7d, [@multicast2, @dev={0xac, 0x14, 0x14, 0x2f}, @empty]}]}}}}}) (async) fstat(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=@ipv4_delroute={0x54, 0x19, 0x1, 0x70bd2b, 0x25dfdbfb, {0x2, 0x80, 0x10, 0x2, 0xfe, 0x0, 0x0, 0x2, 0x1400}, [@RTA_OIF={0x8, 0x4, r2}, @RTA_MARK={0x8}, @RTA_UID={0x8, 0x19, r3}, @RTA_NH_ID={0x8, 0x1e, 0x1}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x3}, @RTA_MARK={0x8, 0x10, 0x5}, @RTA_DPORT={0x6, 0x1d, 0x4e21}]}, 0x54}}, 0x4048054) (async) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, 0x1, 0x4, 0x101, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0xfffffff6}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x3ff}]}, 0x24}, 0x1, 0x0, 0x0, 0xd971b1d02dca9027}, 0x4008084) read$eventfd(r1, &(0x7f00000004c0), 0x8) r4 = dup2(r0, r0) (async) r5 = landlock_create_ruleset(&(0x7f0000000500)={0x1800}, 0x18, 0x2) fallocate(r5, 0x9, 0x7, 0x1) (async) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000540), 0x40) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r6, 0x80045301, &(0x7f0000000580)) (async) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f00000005c0)={0x5, 0x0, [{0x2, 0x80000001, 0x3, 0x6, 0xffffffff}, {0xb, 0x65ab2e1a, 0x0, 0xffff, 0x7}, {0x2, 0x8, 0x8, 0x80000000, 0x7}, {0x40000001, 0x7, 0x1, 0x7, 0x401}, {0x0, 0x4, 0x80000001, 0x2}]}) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0xc, 0xc, &(0x7f0000000640)=@raw=[@map_idx={0x18, 0x4, 0x5, 0x0, 0x4}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 0x5}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0xf5dc}, @cb_func={0x18, 0x4, 0x4, 0x0, 0xfffffffffffffff9}], &(0x7f00000006c0)='GPL\x00', 0x678cd6ff, 0x13, &(0x7f0000000700)=""/19, 0x40f00, 0xc, '\x00', 0x0, @fallback=0x20, r4, 0x8, &(0x7f0000000740)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000780)={0x4, 0xf, 0x186a, 0x5}, 0x10, 0x0, r5, 0x0, 0x0, 0x0, 0x10, 0xebd}, 0x94) (async) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000880)=0x3) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r7, 0x4002f516, &(0x7f00000008c0)={0x50, 0x6}) (async) setsockopt$MRT6_DONE(r1, 0x29, 0xc9, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000940), r1) sendmsg$ETHTOOL_MSG_STRSET_GET(r8, &(0x7f0000000c00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000980)={0x20c, r9, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x7c, 0x2, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x618338331e6f9f17}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x114, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0xd}]}, {0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8}]}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}]}]}, 0x20c}, 0x1, 0x0, 0x0, 0xc000010}, 0x40000) (async) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000c80), r4) sendmsg$TIPC_NL_BEARER_DISABLE(r1, &(0x7f0000000d80)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000d40)={&(0x7f0000000cc0)={0x44, r10, 0x4, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x40000000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x50) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000000dc0)=[@in6={0xa, 0x4e24, 0x2, @dev={0xfe, 0x80, '\x00', 0x30}, 0x5c792f39}], 0x1c) (async) pivot_root(&(0x7f0000000e00)='./file0\x00', &(0x7f0000000e40)='./file1\x00') (async) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000e80), 0x200, 0x0) write$tun(r11, &(0x7f0000000ec0)={@void, @void, @llc={@snap={0x1, 0x0, "b9", "1cab00", 0x88a8, "2437b672c56287b06d5ca2d2bb4f24801c2ae75bf526296e9749e16c5fda9165c6448813ccafd379539bedf2f73102055a28d4efee4cc4865225e894f40ff86f8c32ead8d2fcfc4f059d4192c93763330a26410b490be86ac126c9ded41438a8e416abb3f610e4033bafbd9b9300986c4ae9ecd6bcf015278b156b16289fcb316a8a74c56805796d765728347af73e0ee5fedcdda4c35408afa7f224b42efddd4e0ffb1102a4adaf376c865b3250505a2c053e25d4c3466f15d8d003ec3018d973c5f67b0f2edb3a7633175a11b6449488634459c3dd94568eecd55a1b2764eb15bcd5898897f0b803b71f88"}}}, 0xf4) 1.910098942s ago: executing program 2 (id=4509): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @multicast2}}, 0x1e) connect$pptp(r0, &(0x7f0000000040)={0x18, 0x2, {0x1, @empty}}, 0x1e) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) r1 = syz_io_uring_complete(0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0xffff}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x90}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}, [@printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7}, {0x85, 0x0, 0x0, 0xa0}}, @call={0x85, 0x0, 0x0, 0xd0}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x0, 0x10, 0x10, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r5 = socket(0x10, 0x803, 0x0) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r6, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000680)={0x31}) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x9f) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newlink={0x2c, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r7, 0x500, 0x8}, [@IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x2c}}, 0x8000) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000180)={{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, @in6=@dev={0xfe, 0x80, '\x00', 0x14}, 0x4e24, 0xffe7, 0x4e20, 0x0, 0x2, 0xa0, 0x80, 0x33, r7, 0xffffffffffffffff}, {0x6, 0x0, 0x7, 0x1, 0x5, 0x7fffffff, 0x1, 0x80000001}, {0x0, 0x100000000, 0xc1, 0x7fffffff}, 0x32, 0x6e6bb7, 0x2, 0x1, 0x2, 0x3}, {{@in=@broadcast, 0x4d3, 0x2b}, 0xa, @in=@empty, 0x34ff, 0x1, 0x3, 0x4, 0x7, 0x2}}, 0xe8) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000001010102000000000000000002000000240002800c000280040001003a00000014000180080001cd4bde2a0192000000000000000c0019800800"], 0x44}, 0x1, 0x0, 0x0, 0x200448c1}, 0x40) syz_usb_connect(0x2, 0x6a, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902310001080010000904df0003080662ff09050c02200006060309050710000201020704f99fbb0905"], 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) renameat2(0xffffffffffffff9c, &(0x7f00000008c0)='./file4\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./file7\x00', 0x0) 1.789106889s ago: executing program 3 (id=4510): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000040)=0x200000, 0x4) 1.78811613s ago: executing program 0 (id=4511): socket$inet6_mptcp(0xa, 0x1, 0x106) futex_waitv(&(0x7f0000000ec0)=[{0x3, 0x0, 0x82}, {0x3, 0x0, 0x104}, {0x5, 0x0, 0x82}, {0x0, 0x0, 0x2}, {0x5, 0x0, 0x82}, {0x800, 0x0, 0x82}, {0x80000001, 0x0, 0x2}, {0x4, 0x0, 0x82}, {0x10000, 0x0, 0x82}, {0x7, 0x0, 0x2}, {0xfffffffffffff801, 0x0, 0x2}, {0xffffffffffffffc0, 0x0, 0x2}, {0x6, 0x0, 0x2}, {0x81, 0x0, 0x2}, {0x7f, 0x0, 0x82}, {0xb3, 0x0, 0x2}, {0x5, 0x0, 0x82}, {0x6, 0x0, 0x82}, {0x1000, 0x0, 0x2}, {0x1, 0x0, 0x2}, {0x9, 0x0, 0x2}, {0x6, 0x0, 0x2}, {0x4, 0x0, 0x2}, {0x9, 0x0, 0x2}, {0x2, 0x0, 0x2}, {0x7ff, 0x0, 0x2}, {0x3, 0x0, 0x82}, {0x2, 0x0, 0x82}, {0x8, 0x0, 0x80}, {0x0, 0x0, 0x82}, {0x8, 0x0, 0x82}, {0x8452, 0x0, 0x82}, {0xe6c, 0x0, 0x82}, {0x8000000000000001, 0x0, 0x2}, {0x7, 0x0, 0x2}, {0x3, 0x0, 0x82}, {0x6, 0x0, 0x82}, {0x453f, 0x0, 0x2}, {0x20000000000400, 0x0, 0x82}, {0xfffffffffffffc00, 0x0, 0x82}, {0x8000000000000001, 0x0, 0x82}, {0x6, 0x0, 0x82}, {0xe12c, 0x0, 0x2}, {0x8000, 0x0, 0x2}, {0xfffffffffffffff8, 0x0, 0x2}, {0x6, 0x0, 0x82}, {0xa10, 0x0, 0x82}, {0x100, 0x0, 0x2}, {0x5, 0x0, 0x82}, {0x3, 0x0, 0x82}, {0x9, 0x0, 0x82}, {0x0, 0x0, 0x2}, {0x7985, 0x0, 0x2}, {0x2, 0x0, 0x82}], 0x36, 0x0, &(0x7f0000001440)={0x77359400}, 0x1) socket(0x2, 0x3, 0x6) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x48e80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x200) (async) prlimit64(0x0, 0x7, &(0x7f0000000140), 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="000000000000577e868800"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x2a, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) socket$kcm(0x10, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x1800, 0x0) (async) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) (async) syz_open_dev$midi(&(0x7f00000001c0), 0x2, 0x40c01) (async) write$uinput_user_dev(r2, &(0x7f0000000300)={'syz0\x00', {0xae43, 0xc, 0x3, 0x8c0d}, 0x16, [0x5, 0x4, 0xc, 0x289, 0xc, 0x3, 0x5, 0x5, 0x2, 0x10000, 0x80000000, 0x8, 0xfc, 0xffffffff, 0x3df, 0x9, 0x4, 0x2, 0x100, 0x28000000, 0x9, 0xc, 0x35a, 0x4, 0xc, 0x80000000, 0x2, 0xe, 0x0, 0x7, 0x7, 0x6, 0x10001, 0x5, 0xfff, 0xfffffffc, 0x3, 0x9, 0x3, 0x1c, 0x101, 0x2, 0x4008, 0xca16, 0xffffffff, 0x9, 0x7f, 0x7, 0x82c, 0x0, 0xf895, 0x9, 0x5, 0x9, 0x8001, 0x2c, 0x8001, 0x9, 0x4, 0x8a, 0x9, 0x3, 0x101, 0x401], [0x5, 0x80000001, 0x4, 0x6, 0x4, 0x0, 0x42, 0x3, 0x4, 0x68b0, 0x0, 0x8, 0x5, 0x7, 0x5, 0x0, 0x7, 0xf, 0xc2, 0x6, 0x8, 0x1, 0x3, 0xb5, 0x7, 0xffffff01, 0x59, 0x2, 0x2, 0x7, 0x46, 0xffff52d7, 0x1, 0x6c4b, 0x3, 0x2b8, 0x7, 0x1, 0x5, 0xf6, 0x4a000, 0x6, 0x2, 0x37, 0x2, 0x7fffffff, 0x7, 0xa1, 0x6fca, 0x5, 0x507, 0xc81e, 0x1, 0xe, 0x0, 0x5, 0x7ff, 0xd, 0x1, 0x3, 0x5, 0x8, 0x20000003, 0x3], [0x7f, 0x7, 0x2, 0xe, 0x6, 0x1, 0xcf97, 0x3ff, 0xf1, 0x100, 0x1, 0x6, 0x3d6, 0x0, 0x1207, 0x4, 0x0, 0x9, 0x5e6e, 0x3, 0x8, 0x7, 0x200800, 0x3ff, 0x14, 0x20, 0xa, 0x0, 0x9a, 0xfff, 0x9, 0x2, 0x2, 0x400, 0xfffffffa, 0x8, 0x8165, 0x10000, 0x7, 0x9, 0x2, 0x7, 0x0, 0x18, 0x5, 0x8, 0x5, 0x1ff, 0x0, 0x3, 0x6, 0x9, 0x401, 0x3, 0x9, 0x8, 0xb, 0xd610, 0x81, 0x5d96, 0x8, 0xaf9, 0x800, 0x1], [0xd, 0x2, 0x2, 0x9, 0x1, 0x26, 0x9, 0x40, 0x10, 0xb67, 0xe, 0x8000, 0xa, 0x5, 0x7fff, 0x9, 0x8, 0x1, 0xb, 0x81, 0x0, 0x7c2, 0xe72, 0xf, 0x5, 0xb2, 0xe6ef, 0x8, 0x7, 0x8001, 0x7, 0x0, 0x88f, 0x800, 0x2, 0x70, 0x7f, 0x5, 0x6, 0xff, 0x2, 0x5, 0x7, 0x8, 0x9, 0x3, 0x7, 0x1, 0x0, 0x8, 0x9, 0x3, 0x9, 0x560, 0x2c6, 0x80, 0xfffffffa, 0x7, 0x4, 0x2, 0x3, 0x5, 0x4, 0x100]}, 0x263) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) bind$alg(0xffffffffffffffff, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(morus640)\x00'}, 0x58) (async) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000002, 0x42032, 0xffffffffffffffff, 0x80000000) mremap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000, 0x0, &(0x7f00008b5000/0x1000)=nil) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000180), 0xfea7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16, @ANYBLOB="2d01620000000900509072fb60cb08000300"], 0x2c}, 0x1, 0x0, 0x0, 0x4081}, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16, @ANYBLOB="ff830500000700ffffff", @ANYRES8=r3], 0x4}}, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000e40)={0x2c, &(0x7f0000000c00)={0x40, 0x8, 0x4d, {0x4d, 0x24, "c99824cc86e71e564e771b342a09e8769b78521a8e6e93e25c3f961daec944833333a8d61759d62e7c36ded51122b51ea0c24fbc6a181469b12268aa84f59445f8f2e62cf2ee5253b2b5ac"}}, &(0x7f0000000c80)=ANY=[@ANYBLOB="00035600000056037e5f229bee3d96086a05f951d3310345590ec736782eb5aa869c1cbddca1e0357adecf05e48a572f925795202d3210d3eaa2647507268eccce3951467602668551a67fe702429cdc33139f17b26fd451cffe9654"], &(0x7f0000000d00)={0x0, 0xf, 0x8a, {0x5, 0xf, 0x8a, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x12, 0x4, 0x7, 0xfffc}, @generic={0x67, 0x10, 0x0, "57934af8218d96b6b88af595c49d95115ef1ac7d50b5da733de3f0e56346735589394c740ee9e25d194dd577a380123800630397b2ddaf84d1e060eddb0a8afaf0b7944392e605b0d21900c915bd1b5df2bd15a7e7e259ada477c638cb4c19ce1d59c13c"}, @ssp_cap={0x10, 0x10, 0xa, 0xd, 0x1, 0x7, 0x0, 0x40, [0xfe8000]}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x4, 0xe, 0x4}]}}, &(0x7f0000000dc0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x10, 0x5, 0x3, "24fd9e31", "eebf5cad"}}, &(0x7f0000000e00)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xc, 0x13, 0x1, 0x7, 0x7, 0x5, 0xff00}}}, &(0x7f0000001280)={0x84, &(0x7f0000000e80)={0x0, 0xc, 0x1f, "cb8ecf68ddab28b0fc1a80c29edacc0f0ec0249fe7745cbe5de0c07c2d54af"}, &(0x7f0000000ec0)={0x0, 0xa, 0x1, 0x4}, &(0x7f0000000f00)={0x0, 0x8, 0x1, 0xc0}, &(0x7f0000000f40)={0x20, 0x0, 0x4, {0x3, 0x3}}, &(0x7f0000000f80)={0x20, 0x0, 0x8, {0x1e0, 0x1, [0xf000]}}, &(0x7f0000000fc0)={0x40, 0x7, 0x2, 0xfff7}, &(0x7f0000001000)={0x40, 0x9, 0x1, 0xf}, &(0x7f0000001040)={0x40, 0xb, 0x2, "1871"}, &(0x7f0000001080)={0x40, 0xf, 0x2, 0x7}, &(0x7f00000010c0)={0x40, 0x13, 0x6, @remote}, &(0x7f0000001100)={0x40, 0x17, 0x6, @remote}, &(0x7f0000001140)={0x40, 0x19, 0x2, "8f57"}, &(0x7f0000001180)={0x40, 0x1a, 0x2, 0x58}, &(0x7f00000011c0)={0x40, 0x1c, 0x1, 0x5}, &(0x7f0000001200)={0x40, 0x1e, 0x1, 0x6e}, &(0x7f0000001240)={0x40, 0x21, 0x1, 0x75}}) 1.704768553s ago: executing program 3 (id=4512): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000300)=ANY=[@ANYBLOB="120100001517ee40f00a057a0000010203010902120001000000000904000000ff"], 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x25, &(0x7f0000000080)=[@in={0x2, 0x0, @dev}], 0xffe2) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r2, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0x0, 0x9}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, 0x0, 0x5, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff], [0x0, 0x0, 0x4, 0xb16, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x20000000, 0x0, 0x0, 0x2, 0x0, 0x9, 0x20, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x1000, 0x0, 0xf, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x1, 0x0, 0x0, 0x0, 0xfffffffd, 0xfffffffd, 0x0, 0xfffffffa, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0xe, 0x0, 0x0, 0x0, 0x1], [0x7, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xfffffffc, 0xff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x7, 0x4], [0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc045, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x80, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r2, 0x5501) readv(r2, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/45, 0x2d}], 0x1) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) epoll_create1(0x80000) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000140)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd29, 0x8000, {0x0, 0x0, 0x0, r6, {0x8, 0xffe0}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0xff}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000140)={0x48}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000cc0)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="400f1100000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.635753098s ago: executing program 0 (id=4513): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000000)=0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001a80)={0x4, 0x0, &(0x7f0000001900)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="a1"}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) timer_settime(r1, 0x0, &(0x7f0000000140)={{0x77359400}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, 0x0) unshare(0x2040400) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x101302, 0x0) fdatasync(r2) r3 = landlock_create_ruleset(&(0x7f0000000080)={0x2000, 0x2, 0x2}, 0x18, 0x4) landlock_restrict_self(r3, 0xfb9c11a02ef5cc09) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, 0xffffffffffffffff, 0x0) 1.393050894s ago: executing program 0 (id=4514): syz_emit_ethernet(0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000e08004500003c000000000006907864010102ac1414aa40010000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="ac000001907800000000000000000fff0000000000000000"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4010) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SENDMSG={0x9, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000001c00)={0x0, 0x0, 0x0}, 0x0, 0x0, 0x1}) io_uring_enter(0xffffffffffffffff, 0x47f5, 0x6021, 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000800030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xc4}, 0x890) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="34000000150a03000000000000000000020000000900020073797a310000000008000340000000010900010073797a30"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x8, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x3, 0x2, 0x3, 0x1, 0x0, 0x3a}]}, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1b, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x800}}, 0x0, 0x8, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x800}, 0x94) r3 = socket$kcm(0x2, 0x200000000000001, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x50, &(0x7f0000000100), 0x48) 307.837958ms ago: executing program 1 (id=4515): socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000304fc0400"/20, @ANYRES32=0x0, @ANYBLOB="a5fdad8800000000240012800b000100627269646765000014000280050019000600000005001800010000"], 0x44}, 0x1, 0x300000000000000, 0x0, 0x4004}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(0xffffffffffffffff, 0xc01064c1, &(0x7f0000000200)={r4}) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x40000) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r7, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) open_by_handle_at(r5, &(0x7f0000000240)=ANY=[@ANYBLOB="280000004e000010cc000000000000000180e127d6fb000000822d0cfc0000000000000000000000ff7fffffffffd70e8cb3974479ee000000000636b6428b85551445fd5b3dc47e68ade701be286e7aa4613038a31f386ac23e87fadc61a6160a14a500"], 0x10000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) 177.528058ms ago: executing program 2 (id=4516): r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x8801, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f00000000c0)={0x0, 0xfad3, 0x1, 0x0, 0x0, "f6a6756c9832488c"}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$kcm(0xa, 0x922000000003, 0x11) recvmsg$kcm(r2, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000024000/0x18000)=nil, &(0x7f0000000680)=[@text16={0x10, 0x0}], 0x1, 0x7d, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000005c0)=[{0x0}], 0x1, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000300)={[0x7, 0x800, 0x100, 0x0, 0x5700000000000000, 0x401, 0x6, 0xfffffffffffffff7, 0x0, 0x13f, 0x100000001, 0xba25, 0xde2b, 0x3, 0xfffffffffffffe00, 0x4], 0xeeef0000, 0x1c0080}) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg(r4, &(0x7f0000000180), 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x80108907, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r8, 0x6, 0xe, &(0x7f00000012c0)={@in6={{0xa, 0x4e22, 0x0, @mcast2}}, 0x0, 0x0, 0x34, 0x0, "0c9e089c1b4a04000bde79f04103c458187eb46c2d996aff287154e786455261c425a7519cc275d04e6205abd307a0c4fa3838bf399ad5bd35f21907c7988d1300"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r8, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0x0, @private1={0xfc, 0x1, '\x00', 0xfe}, 0x2}}, 0x0, 0x0, 0x4, 0x0, "a1c1dd75a6843e10951cd4b347113e55eb499519becf7542c90bc21470e441225642855b5f2faed4a18d67efd5f2fdf98328de94410300"}, 0xd8) ioctl$DRM_IOCTL_INFO_BUFS(0xffffffffffffffff, 0xc0106418, &(0x7f0000000380)={0x200, 0x4, 0x6, 0x80, 0x0, 0x200}) setsockopt$inet6_tcp_TCP_MD5SIG(r8, 0x6, 0xe, &(0x7f0000000800)={@in6={{0xa, 0x4e23, 0x3, @loopback, 0x2}}, 0x0, 0x0, 0x1f, 0x0, "7c873eb0bf1265b9078a4c0301f7b9cc8644e953d839116ef5ba50526bb9deb02f583135a4e16fc10aca34d7b8f225748bce05090f9d8408c3e19eb58d1c1f7d38406a15840417cc1b0aa76c26d22f09"}, 0xd8) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_CONGESTION(r9, 0x6, 0xd, &(0x7f0000000340)='hybla\x00', 0x6) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x3b, 0x2, [{0xfe}, {0xfffffff9}]}}) 0s ago: executing program 3 (id=4517): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000200)) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r0, 0x2287, &(0x7f0000000040)=0x280) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="850000006300fbff6500000000000a00006cfe019cb62fd3df"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) syz_usb_connect(0x0, 0x33, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007b8955403a0976245b0d0102030109022100010d20000009040000000e0100000f2402010102", @ANYRESHEX], 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.dequeue\x00', 0x26e1, 0x0) close(r1) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001240)) ioctl$SIOCSIFHWADDR(r1, 0x8b19, &(0x7f0000000000)={'wlan0\x00', @random="7cf1e97c9e4f"}) kernel console output (not intermixed with test programs): d, idProduct=00b3, bcdDevice=2d.ea [ 1825.420846][T14273] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1825.428952][T14273] usb 3-1: Product: syz [ 1825.435085][T14273] usb 3-1: Manufacturer: syz [ 1825.439711][T14273] usb 3-1: SerialNumber: syz [ 1825.448264][T14273] usb 3-1: config 0 descriptor?? [ 1825.507952][ T977] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1825.586971][ T977] gp8psk_fe: Frontend revision 1 attached [ 1825.614875][ T977] usb 2-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 1825.652025][ T5900] usb 1-1: USB disconnect, device number 86 [ 1825.674734][T14273] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1825.705809][ T977] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 1825.804529][T25071] FAULT_INJECTION: forcing a failure. [ 1825.804529][T25071] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1825.818581][T25071] CPU: 0 UID: 0 PID: 25071 Comm: syz.5.4178 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1825.818607][T25071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1825.818618][T25071] Call Trace: [ 1825.818626][T25071] [ 1825.818637][T25071] dump_stack_lvl+0x189/0x250 [ 1825.818667][T25071] ? __pfx____ratelimit+0x10/0x10 [ 1825.818693][T25071] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1825.818718][T25071] ? __pfx__printk+0x10/0x10 [ 1825.818738][T25071] ? __might_fault+0xb0/0x130 [ 1825.818767][T25071] should_fail_ex+0x414/0x560 [ 1825.818793][T25071] _copy_from_user+0x2d/0xb0 [ 1825.818811][T25071] get_nodes+0x17f/0x390 [ 1825.818834][T25071] ? __pfx_get_nodes+0x10/0x10 [ 1825.818857][T25071] ? ksys_write+0x1cb/0x250 [ 1825.818879][T25071] __se_sys_mbind+0x18d/0xc30 [ 1825.818903][T25071] ? __pfx_vfs_write+0x10/0x10 [ 1825.818931][T25071] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1825.818958][T25071] ? __pfx___se_sys_mbind+0x10/0x10 [ 1825.818983][T25071] ? __fget_files+0x3a0/0x420 [ 1825.819007][T25071] ? fput+0xa0/0xd0 [ 1825.819028][T25071] ? ksys_write+0x22a/0x250 [ 1825.819055][T25071] ? __x64_sys_mbind+0x21/0xf0 [ 1825.819082][T25071] do_syscall_64+0xfa/0x3b0 [ 1825.819105][T25071] ? lockdep_hardirqs_on+0x9c/0x150 [ 1825.819128][T25071] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1825.819146][T25071] ? clear_bhb_loop+0x60/0xb0 [ 1825.819173][T25071] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1825.819190][T25071] RIP: 0033:0x7faaf518e929 [ 1825.819206][T25071] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1825.819222][T25071] RSP: 002b:00007faaf60af038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed [ 1825.819241][T25071] RAX: ffffffffffffffda RBX: 00007faaf53b5fa0 RCX: 00007faaf518e929 [ 1825.819255][T25071] RDX: 0000000000004000 RSI: 0000000000004000 RDI: 0000200000ffb000 [ 1825.819267][T25071] RBP: 00007faaf60af090 R08: 0000000000002d02 R09: 0000000000000004 [ 1825.819279][T25071] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000002 [ 1825.819292][T25071] R13: 0000000000000001 R14: 00007faaf53b5fa0 R15: 00007faaf54dfa28 [ 1825.819320][T25071] [ 1826.538567][ T977] gp8psk: usb in 138 operation failed. [ 1826.544598][ T977] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected. [ 1826.558741][ T977] gp8psk: found Genpix USB device pID = 201 (hex) [ 1826.568444][ T977] usb 2-1: USB disconnect, device number 84 [ 1826.680225][ T977] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected. [ 1826.742255][ T5907] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1826.762395][ T5900] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 1826.897187][T25088] netlink: 'syz.3.4183': attribute type 4 has an invalid length. [ 1826.905313][ T5907] usb 6-1: Using ep0 maxpacket: 16 [ 1826.912793][T25088] netlink: 152 bytes leftover after parsing attributes in process `syz.3.4183'. [ 1826.927190][ T5900] usb 1-1: Using ep0 maxpacket: 16 [ 1826.933611][ T5907] usb 6-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4 [ 1826.944479][ T5907] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1826.975621][ T5900] usb 1-1: config index 0 descriptor too short (expected 52, got 18) [ 1826.989989][ T5907] usb 6-1: Product: syz [ 1826.996775][ T5900] usb 1-1: config 130 has an invalid descriptor of length 237, skipping remainder of the config [ 1827.007581][ T5907] usb 6-1: Manufacturer: syz [ 1827.012524][ T5907] usb 6-1: SerialNumber: syz [ 1827.017739][ T5900] usb 1-1: config 130 has 0 interfaces, different from the descriptor's value: 1 [ 1827.029481][ T5907] usb 6-1: config 0 descriptor?? [ 1827.038688][ T5900] usb 1-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4 [ 1827.050022][ T5907] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state. [ 1827.058981][ T5900] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1827.067466][ T5900] usb 1-1: Product: syz [ 1827.072349][ T5900] usb 1-1: Manufacturer: syz [ 1827.077038][ T5900] usb 1-1: SerialNumber: syz [ 1827.283072][ T5907] gp8psk: usb in 128 operation failed. [ 1827.292874][ T5907] gp8psk: usb in 137 operation failed. [ 1827.305552][ T5907] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1827.330729][ T5907] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver) [ 1827.348066][ T5900] usb 1-1: USB disconnect, device number 87 [ 1827.360493][ T5907] usb 6-1: media controller created [ 1827.469405][ T5907] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1827.506536][ T5907] gp8psk_fe: Frontend revision 1 attached [ 1827.528692][ T5907] usb 6-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 1827.584380][ T5907] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 1827.744319][T14273] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1827.762311][T14273] usb 3-1: USB disconnect, device number 86 [ 1828.024453][ T5907] gp8psk: usb in 138 operation failed. [ 1828.031396][ T5907] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected. [ 1828.063329][T25106] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4187'. [ 1828.175844][ T5907] gp8psk: found Genpix USB device pID = 201 (hex) [ 1828.266603][ T5907] usb 6-1: USB disconnect, device number 28 [ 1828.417309][T25108] netlink: 136 bytes leftover after parsing attributes in process `syz.1.4189'. [ 1828.438492][T25108] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 1828.530543][ T5907] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected. [ 1828.634089][ T5835] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1829.425593][ T5835] usb 4-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 1829.438226][ T5835] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1829.457317][ T5835] usb 4-1: config 0 descriptor?? [ 1829.484258][ T5835] gspca_main: spca508-2.14.0 probing 8086:0110 [ 1829.675911][T25110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1829.732828][T25110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1829.779433][T25130] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4193'. [ 1829.808280][ T5835] gspca_spca508: reg_read err -32 [ 1829.877512][ T5835] gspca_spca508: reg_read err -71 [ 1829.898551][ T5835] gspca_spca508: reg_read err -71 [ 1830.085972][ T5835] gspca_spca508: reg_read err -71 [ 1830.091361][ T5835] gspca_spca508: reg_read err -71 [ 1830.097302][ T5835] gspca_spca508: reg write: error -71 [ 1830.112354][ T5835] spca508 4-1:0.0: probe with driver spca508 failed with error -71 [ 1830.216123][ T5835] usb 4-1: USB disconnect, device number 78 [ 1831.002358][ T5934] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 1831.125506][T25149] bridge3: entered promiscuous mode [ 1831.186987][ T5934] usb 2-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 1831.223920][T25150] IPVS: sh: UDP 224.0.0.2:0 - no destination available [ 1831.235541][ T5934] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1831.255430][ T5934] usb 2-1: Product: syz [ 1831.271227][ T5934] usb 2-1: Manufacturer: syz [ 1831.280000][ T5934] usb 2-1: SerialNumber: syz [ 1831.298749][ T5934] usb 2-1: config 0 descriptor?? [ 1831.632096][T25136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1831.672886][T25136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1832.751199][T25159] FAULT_INJECTION: forcing a failure. [ 1832.751199][T25159] name failslab, interval 1, probability 0, space 0, times 0 [ 1832.772270][T25159] CPU: 1 UID: 0 PID: 25159 Comm: syz.3.4202 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1832.772287][T25159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1832.772294][T25159] Call Trace: [ 1832.772298][T25159] [ 1832.772303][T25159] dump_stack_lvl+0x189/0x250 [ 1832.772323][T25159] ? __pfx____ratelimit+0x10/0x10 [ 1832.772341][T25159] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1832.772356][T25159] ? __pfx__printk+0x10/0x10 [ 1832.772374][T25159] ? __pfx___might_resched+0x10/0x10 [ 1832.772388][T25159] ? fs_reclaim_acquire+0x7d/0x100 [ 1832.772402][T25159] should_fail_ex+0x414/0x560 [ 1832.772417][T25159] should_failslab+0xa8/0x100 [ 1832.772429][T25159] kmem_cache_alloc_lru_noprof+0x78/0x3d0 [ 1832.772444][T25159] ? __d_alloc+0x31/0x6f0 [ 1832.772459][T25159] __d_alloc+0x31/0x6f0 [ 1832.772474][T25159] d_alloc+0x4b/0x190 [ 1832.772484][T25159] ? lookup_one_qstr_excl_raw+0xb4/0x280 [ 1832.772498][T25159] lookup_one_qstr_excl_raw+0xc8/0x280 [ 1832.772513][T25159] do_renameat2+0x470/0xc50 [ 1832.772533][T25159] ? __pfx_do_renameat2+0x10/0x10 [ 1832.772551][T25159] ? getname_flags+0x1e5/0x540 [ 1832.772564][T25159] __x64_sys_renameat2+0xce/0xe0 [ 1832.772576][T25159] do_syscall_64+0xfa/0x3b0 [ 1832.772589][T25159] ? lockdep_hardirqs_on+0x9c/0x150 [ 1832.772603][T25159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1832.772619][T25159] ? clear_bhb_loop+0x60/0xb0 [ 1832.772631][T25159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1832.772640][T25159] RIP: 0033:0x7f3b6658e929 [ 1832.772650][T25159] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1832.772658][T25159] RSP: 002b:00007f3b674a0038 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 1832.772670][T25159] RAX: ffffffffffffffda RBX: 00007f3b667b5fa0 RCX: 00007f3b6658e929 [ 1832.772677][T25159] RDX: ffffffffffffff9c RSI: 00002000000008c0 RDI: ffffffffffffff9c [ 1832.772684][T25159] RBP: 00007f3b674a0090 R08: 0000000000000000 R09: 0000000000000000 [ 1832.772691][T25159] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000001 [ 1832.772697][T25159] R13: 0000000000000000 R14: 00007f3b667b5fa0 R15: 00007f3b668dfa28 [ 1832.772712][T25159] [ 1833.171151][ T5934] usb 2-1: f81604_read: reg: 105 failed: -EPROTO [ 1833.177674][ T5934] f81604 2-1:0.0: Setting termination of CH#0 failed: -EPROTO [ 1833.190053][ T5934] f81604 2-1:0.0: probe with driver f81604 failed with error -71 [ 1833.213316][ T5934] usb 2-1: USB disconnect, device number 85 [ 1833.362494][ T5835] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1833.532037][ T5835] usb 4-1: Using ep0 maxpacket: 16 [ 1833.547532][ T5835] usb 4-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4 [ 1833.557575][ T5835] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1833.575077][ T5835] usb 4-1: Product: syz [ 1833.585162][ T5835] usb 4-1: Manufacturer: syz [ 1833.598516][ T5835] usb 4-1: SerialNumber: syz [ 1833.610448][ T5835] usb 4-1: config 0 descriptor?? [ 1833.626426][ T5835] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state. [ 1833.846826][ T5835] gp8psk: usb in 128 operation failed. [ 1833.871608][ T5835] gp8psk: usb in 137 operation failed. [ 1833.887960][ T5835] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1833.910168][ T5835] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver) [ 1833.934851][ T5835] usb 4-1: media controller created [ 1834.071720][ T5835] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1834.193988][ T5835] gp8psk_fe: Frontend revision 1 attached [ 1834.232387][ T5835] usb 4-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 1834.278421][ T5835] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 1835.049857][ T5835] gp8psk: usb in 138 operation failed. [ 1835.419071][ T5835] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected. [ 1835.431612][ T5835] gp8psk: found Genpix USB device pID = 201 (hex) [ 1835.449428][ T5835] usb 4-1: USB disconnect, device number 79 [ 1835.820619][ T5835] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected. [ 1836.663588][T14273] usb 3-1: new full-speed USB device number 87 using dummy_hcd [ 1836.826277][T14273] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1836.836899][T14273] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1836.846979][T14273] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1836.876831][T14273] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1836.953853][T14273] usb 3-1: config 0 descriptor?? [ 1836.960764][T25230] input: syz1 as /devices/virtual/input/input112 [ 1837.010973][T25230] input: failed to attach handler leds to device input112, error: -6 [ 1837.047317][T14273] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1837.069928][T14273] dvb-usb: bulk message failed: -22 (3/0) [ 1837.103765][T14273] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1837.127243][T14273] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1837.161323][T14273] usb 3-1: media controller created [ 1837.180922][T14273] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1837.253774][T14273] dvb-usb: bulk message failed: -22 (6/0) [ 1837.272993][T14273] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1837.362325][T14273] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input113 [ 1837.414239][T14273] dvb-usb: schedule remote query interval to 150 msecs. [ 1837.482307][T14273] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1837.643138][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1837.648891][ T5907] dvb-usb: error while querying for an remote control event. [ 1837.802088][T14273] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 1837.822382][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1837.828242][ T5907] dvb-usb: error while querying for an remote control event. [ 1837.832129][ T5934] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1837.965045][T14273] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1837.989158][T14273] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1837.997773][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1838.002170][ T5934] usb 6-1: Using ep0 maxpacket: 8 [ 1838.014887][ T5907] dvb-usb: error while querying for an remote control event. [ 1838.016843][ T5934] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 1838.033342][ T5934] usb 6-1: config 179 has no interface number 0 [ 1838.047945][ T5934] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1838.067830][ T5934] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1838.081457][ T5934] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1838.082562][T14273] usb 2-1: config 0 descriptor?? [ 1838.101634][ T5934] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1838.122264][ T5934] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1838.131651][ T5934] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1838.151893][T25244] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1838.232362][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1838.238198][ T5907] dvb-usb: error while querying for an remote control event. [ 1838.422338][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1838.422590][ T5934] input: Generic X-Box pad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:179.65/input/input114 [ 1838.546271][ T5907] dvb-usb: error while querying for an remote control event. [ 1838.601639][ T5900] usb 6-1: USB disconnect, device number 29 [ 1838.601736][ C1] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1838.616192][ C1] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1838.624581][ T5900] xpad 6-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 1838.723400][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1838.730563][ T5907] dvb-usb: error while querying for an remote control event. [ 1838.902429][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1838.908174][ T5907] dvb-usb: error while querying for an remote control event. [ 1839.114892][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1839.120696][ T5907] dvb-usb: error while querying for an remote control event. [ 1839.312206][T14273] ath6kl: Failed to submit usb control message: -110 [ 1839.319002][T14273] ath6kl: unable to send the bmi data to the device: -110 [ 1839.352392][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 1839.413328][ T5907] dvb-usb: error while querying for an remote control event. [ 1839.421682][T14273] ath6kl: Unable to send get target info: -110 [ 1839.442958][T14273] ath6kl: Failed to init ath6kl core: -110 [ 1839.450068][T14273] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1839.539426][T14273] usb 3-1: USB disconnect, device number 87 [ 1840.002259][ T5907] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1840.193699][ T5907] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1840.203540][ T5907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1840.211626][ T5907] usb 4-1: Product: syz [ 1840.216258][ T5907] usb 4-1: Manufacturer: syz [ 1840.220976][ T5907] usb 4-1: SerialNumber: syz [ 1840.231707][ T5907] usb 4-1: config 0 descriptor?? [ 1840.312134][ T5908] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 1840.420518][T14273] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1840.474115][T25262] input: syz0 as /devices/virtual/input/input115 [ 1840.528394][ T5908] usb 1-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 1840.763217][ T5908] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1840.771273][ T5908] usb 1-1: Product: syz [ 1840.810745][ T5908] usb 1-1: Manufacturer: syz [ 1840.833761][ T5908] usb 1-1: SerialNumber: syz [ 1840.840624][ T5907] hso 4-1:0.0: Can't find BULK IN endpoint [ 1840.874307][ T5908] usb 1-1: config 0 descriptor?? [ 1840.880301][ T5907] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1840.908865][ T5900] usb 2-1: USB disconnect, device number 86 [ 1841.739531][ T5900] usb 4-1: USB disconnect, device number 80 [ 1841.765247][T25271] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1841.836253][T25271] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1842.072155][ T5907] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 1842.255828][ T5907] usb 2-1: config 0 has no interfaces? [ 1842.278284][ T5907] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1842.310351][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1842.330585][ T5907] usb 2-1: Product: syz [ 1842.343748][ T5907] usb 2-1: Manufacturer: syz [ 1842.356094][ T5907] usb 2-1: SerialNumber: syz [ 1842.485577][ T5907] usb 2-1: config 0 descriptor?? [ 1842.501411][T25294] netlink: 'syz.3.4242': attribute type 1 has an invalid length. [ 1842.638275][T25294] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1842.741887][T25298] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1842.872811][T25297] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1842.889323][T25297] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 1842.940336][T25297] bond2: (slave vxcan1): Error -95 calling set_mac_address [ 1843.000282][ T5908] usb 1-1: f81604_read: reg: 105 failed: -EPROTO [ 1843.008202][ T5908] f81604 1-1:0.0: Setting termination of CH#0 failed: -EPROTO [ 1843.015909][ T5907] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 1843.026013][ T5908] f81604 1-1:0.0: probe with driver f81604 failed with error -71 [ 1843.037806][ T5908] usb 1-1: USB disconnect, device number 88 [ 1843.172056][ T5907] usb 3-1: Using ep0 maxpacket: 32 [ 1843.183728][ T5907] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1843.193217][ T5907] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1843.218556][ T5907] usb 3-1: config 0 descriptor?? [ 1843.240482][ T5907] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1843.362116][ T5908] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 1843.462067][ T5900] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1843.485461][T25294] gretap1: entered promiscuous mode [ 1843.499948][T25294] bond2: (slave gretap1): making interface the new active one [ 1843.509031][T25294] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 1843.539445][ T5908] usb 1-1: Using ep0 maxpacket: 16 [ 1843.550684][ T5908] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 1843.559698][ T5908] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1843.570693][ T5908] usb 1-1: config 0 has no interface number 0 [ 1843.579674][T25303] bond2: (slave vlan2): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 1843.582166][ T5908] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1843.601148][ T5908] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1843.611374][ T5908] usb 1-1: Product: syz [ 1843.618199][ T5908] usb 1-1: Manufacturer: syz [ 1843.623224][ T5900] usb 6-1: Using ep0 maxpacket: 8 [ 1843.642607][ T5908] usb 1-1: SerialNumber: syz [ 1843.650185][ T5900] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 1843.670132][ T5900] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.00 [ 1843.681285][ T5900] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1843.701900][ T5908] usb 1-1: config 0 descriptor?? [ 1843.713938][ T5900] usb 6-1: config 0 descriptor?? [ 1843.753849][ T5907] gspca_vc032x: reg_r err -110 [ 1843.774014][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.791852][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.805499][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.822460][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.833160][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.838565][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.844589][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.852704][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.864713][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.882757][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.895862][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.908369][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.916767][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.926782][ T5908] usb 1-1: Found UVC 0.00 device syz (046d:08f3) [ 1843.934086][ T5908] usb 1-1: No valid video chain found. [ 1843.952512][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.957911][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.963917][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.969417][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1843.975250][ T5907] gspca_vc032x: I2c Bus Busy Wait 00 [ 1844.009631][ T5907] gspca_vc032x: Unknown sensor... [ 1844.043889][ T5907] vc032x 3-1:0.0: probe with driver vc032x failed with error -22 [ 1844.094252][ T977] usb 2-1: USB disconnect, device number 87 [ 1844.134940][ T5934] usb 1-1: USB disconnect, device number 89 [ 1844.141398][ T5900] corsair 0003:1B1C:1B09.001A: unbalanced delimiter at end of report description [ 1844.151358][ T5900] corsair 0003:1B1C:1B09.001A: parse failed [ 1844.159771][ T5900] corsair 0003:1B1C:1B09.001A: probe with driver corsair failed with error -22 [ 1844.401016][ T5900] usb 6-1: USB disconnect, device number 30 [ 1844.452972][ T5907] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 1844.563052][ T977] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 1844.615086][ T5907] usb 4-1: config 5 has an invalid interface number: 123 but max is 0 [ 1844.623508][ T5907] usb 4-1: config 5 has no interface number 0 [ 1844.630162][ T5907] usb 4-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 1844.642806][ T5907] usb 4-1: config 5 interface 123 altsetting 7 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1844.652853][ T5907] usb 4-1: config 5 interface 123 has no altsetting 0 [ 1844.663641][ T5907] usb 4-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 1844.674250][ T5907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1844.682822][ T5907] usb 4-1: Product: syz [ 1844.687298][ T5907] usb 4-1: Manufacturer: syz [ 1844.691918][ T5907] usb 4-1: SerialNumber: syz [ 1844.702282][ T977] usb 2-1: device descriptor read/64, error -71 [ 1844.924258][ T5907] ni6501 4-1:5.123: driver 'ni6501' failed to auto-configure device. [ 1844.943339][ T977] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 1844.956228][ T5907] usb 4-1: USB disconnect, device number 81 [ 1845.114898][ T977] usb 2-1: device descriptor read/64, error -71 [ 1845.182193][ T5900] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 1845.303454][ T977] usb usb2-port1: attempt power cycle [ 1845.324590][ T5907] usb 3-1: USB disconnect, device number 88 [ 1845.395574][ T5900] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1845.407222][ T5900] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1845.417162][ T5900] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1845.450601][ T5900] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1845.493385][ T5900] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1845.627367][ T5900] usb 1-1: config 0 descriptor?? [ 1845.911114][ T977] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 1845.981216][ T977] usb 2-1: device descriptor read/8, error -71 [ 1846.103913][T25339] FAULT_INJECTION: forcing a failure. [ 1846.103913][T25339] name failslab, interval 1, probability 0, space 0, times 0 [ 1846.130249][ T5900] plantronics 0003:047F:FFFF.001B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 1846.194321][T25339] CPU: 1 UID: 0 PID: 25339 Comm: syz.3.4256 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1846.194349][T25339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1846.194360][T25339] Call Trace: [ 1846.194367][T25339] [ 1846.194375][T25339] dump_stack_lvl+0x189/0x250 [ 1846.194405][T25339] ? __pfx____ratelimit+0x10/0x10 [ 1846.194430][T25339] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1846.194455][T25339] ? __pfx__printk+0x10/0x10 [ 1846.194480][T25339] ? __pfx___might_resched+0x10/0x10 [ 1846.194505][T25339] ? fs_reclaim_acquire+0x7d/0x100 [ 1846.194530][T25339] should_fail_ex+0x414/0x560 [ 1846.194558][T25339] should_failslab+0xa8/0x100 [ 1846.194578][T25339] __kmalloc_noprof+0xcb/0x4f0 [ 1846.194602][T25339] ? kfree+0x4d/0x440 [ 1846.194623][T25339] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1846.194652][T25339] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1846.194677][T25339] ? tomoyo_domain+0xd9/0x130 [ 1846.194706][T25339] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1846.194726][T25339] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1846.194753][T25339] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1846.194789][T25339] ? __lock_acquire+0xab9/0xd20 [ 1846.194833][T25339] ? __fget_files+0x2a/0x420 [ 1846.194856][T25339] ? __fget_files+0x2a/0x420 [ 1846.194874][T25339] ? __fget_files+0x3a0/0x420 [ 1846.194891][T25339] ? __fget_files+0x2a/0x420 [ 1846.194911][T25339] security_file_ioctl+0xcb/0x2d0 [ 1846.194933][T25339] __se_sys_ioctl+0x47/0x170 [ 1846.194960][T25339] do_syscall_64+0xfa/0x3b0 [ 1846.194983][T25339] ? lockdep_hardirqs_on+0x9c/0x150 [ 1846.195005][T25339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1846.195023][T25339] ? clear_bhb_loop+0x60/0xb0 [ 1846.195045][T25339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1846.195063][T25339] RIP: 0033:0x7f3b6658e929 [ 1846.195079][T25339] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1846.195095][T25339] RSP: 002b:00007f3b674a0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1846.195115][T25339] RAX: ffffffffffffffda RBX: 00007f3b667b5fa0 RCX: 00007f3b6658e929 [ 1846.195128][T25339] RDX: 0000200000000100 RSI: 00000000c034564b RDI: 0000000000000003 [ 1846.195141][T25339] RBP: 00007f3b674a0090 R08: 0000000000000000 R09: 0000000000000000 [ 1846.195154][T25339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1846.195165][T25339] R13: 0000000000000000 R14: 00007f3b667b5fa0 R15: 00007f3b668dfa28 [ 1846.195195][T25339] [ 1846.195855][T25339] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1846.379781][T25343] xt_hashlimit: max too large, truncated to 1048576 [ 1846.430684][ T977] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 1846.451822][T25324] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4252'. [ 1846.579935][ T977] usb 2-1: device descriptor read/8, error -71 [ 1846.674247][T25324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1846.683235][T25324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1846.696477][ T977] usb usb2-port1: unable to enumerate USB device [ 1847.132782][ T5900] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1847.252062][ T977] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1847.316970][T25369] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4264'. [ 1847.342850][ T5900] usb 6-1: config 0 has no interfaces? [ 1847.355497][ T5900] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1847.365366][ T5900] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1847.378945][ T5900] usb 6-1: Product: syz [ 1847.385506][ T5900] usb 6-1: Manufacturer: syz [ 1847.392064][ T5900] usb 6-1: SerialNumber: syz [ 1847.402593][ T5900] usb 6-1: config 0 descriptor?? [ 1847.433565][ T977] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1847.464357][ T977] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1847.554712][ T977] usb 4-1: config 0 descriptor?? [ 1847.762318][ T5907] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 1847.770052][ T5900] usb 1-1: reset high-speed USB device number 90 using dummy_hcd [ 1847.942133][ T5907] usb 2-1: Using ep0 maxpacket: 8 [ 1848.032656][ T5907] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 1848.040969][ T5907] usb 2-1: config 179 has no interface number 0 [ 1848.048459][ T5907] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 1848.059964][ T5907] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 1848.073954][ T5907] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 52, changing to 9 [ 1848.092452][ T5907] usb 2-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8241, setting to 1024 [ 1848.298737][ T5907] usb 2-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1848.329057][ T5907] usb 2-1: config 179 interface 65 has no altsetting 0 [ 1848.341617][ T5907] usb 2-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 1848.572816][ T5907] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1848.642936][ T977] ath6kl: Failed to submit usb control message: -110 [ 1848.648821][ T5907] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input116 [ 1848.671613][ T977] ath6kl: unable to send the bmi data to the device: -110 [ 1848.690707][ T977] ath6kl: Unable to send get target info: -110 [ 1848.792765][ T977] ath6kl: Failed to init ath6kl core: -110 [ 1848.795110][ T5908] usb 1-1: USB disconnect, device number 90 [ 1848.800079][ T977] ath6kl_usb 4-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1848.813867][ T5188] input input116: unable to receive magic message: -110 [ 1848.850570][T25387] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4269'. [ 1848.892189][ T5188] input input116: unable to receive magic message: -32 [ 1848.961575][ T5188] input input116: unable to receive magic message: -32 [ 1849.378653][ T5188] input input116: unable to receive magic message: -32 [ 1849.388821][ T5188] input input116: unable to receive magic message: -32 [ 1849.407873][ T5188] input input116: unable to receive magic message: -32 [ 1850.572335][ T5934] usb 2-1: USB disconnect, device number 92 [ 1850.572342][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1850.586621][ T5934] xpad 2-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 1850.740035][ T5908] usb 4-1: USB disconnect, device number 82 [ 1850.838868][T22988] usb 6-1: USB disconnect, device number 31 [ 1851.100116][T25417] netlink: 'syz.3.4279': attribute type 10 has an invalid length. [ 1851.118704][T25417] team0: Device dummy0 failed to register rx_handler [ 1851.274093][ T5934] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 1851.445075][ T5934] usb 2-1: Using ep0 maxpacket: 32 [ 1851.457940][ T5934] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1851.472171][ T5934] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1851.485857][ T5934] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1851.495718][ T5934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1851.502290][T22988] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 1851.526870][ T5934] usb 2-1: config 0 descriptor?? [ 1851.672171][ T5835] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 1851.764890][T22988] usb 3-1: config 0 has no interfaces? [ 1851.780082][T22988] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1851.791892][T22988] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1851.802290][ T5908] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 1851.852231][ T5835] usb 4-1: Using ep0 maxpacket: 32 [ 1851.859817][ T5835] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1851.888994][ T5835] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1851.904367][T22988] usb 3-1: Product: syz [ 1851.908559][T22988] usb 3-1: Manufacturer: syz [ 1851.922298][T22988] usb 3-1: SerialNumber: syz [ 1851.942797][T22988] usb 3-1: config 0 descriptor?? [ 1851.979484][ T5835] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1852.036150][ T5835] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1852.116987][ T5908] usb 1-1: config 0 has no interfaces? [ 1852.118550][ T5934] ft260 0003:0403:6030.001C: unknown main item tag 0x0 [ 1852.142893][ T5835] usb 4-1: config 0 descriptor?? [ 1852.151901][ T5908] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1852.186029][T25431] @: renamed from vlan0 (while UP) [ 1852.212588][T25411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1852.223605][T25411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1852.257564][T25421] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4280'. [ 1852.275316][ T5908] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1852.289296][ T5908] usb 1-1: Product: syz [ 1852.296052][ T5908] usb 1-1: Manufacturer: syz [ 1852.300822][ T5908] usb 1-1: SerialNumber: syz [ 1852.310998][ T5934] ft260 0003:0403:6030.001C: chip code: 6424 8183 [ 1852.342767][ T5908] usb 1-1: config 0 descriptor?? [ 1852.377388][T25433] fuse: Unknown parameter 'mask' [ 1852.511573][ T5934] ft260 0003:0403:6030.001C: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0 [ 1852.590017][T25427] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4282'. [ 1852.683922][ T5835] savu 0003:1E7D:2D5A.001D: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 1852.724108][ T5934] ft260 0003:0403:6030.001C: failed to retrieve status: -32, no wakeup [ 1852.736477][ T5934] ft260 0003:0403:6030.001C: failed to retrieve status: -5 [ 1852.946146][T25425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1852.955816][T25425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1853.047067][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1853.053916][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1853.135795][T25439] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4283'. [ 1853.437683][T25443] FAULT_INJECTION: forcing a failure. [ 1853.437683][T25443] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1853.458573][ T5934] ft260 0003:0403:6030.001C: failed to reset I2C controller: -71 [ 1853.508181][ T5934] usb 2-1: USB disconnect, device number 93 [ 1853.520115][T25443] CPU: 0 UID: 0 PID: 25443 Comm: syz.5.4286 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1853.520141][T25443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1853.520152][T25443] Call Trace: [ 1853.520161][T25443] [ 1853.520169][T25443] dump_stack_lvl+0x189/0x250 [ 1853.520200][T25443] ? __pfx____ratelimit+0x10/0x10 [ 1853.520225][T25443] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1853.520249][T25443] ? __pfx__printk+0x10/0x10 [ 1853.520279][T25443] should_fail_ex+0x414/0x560 [ 1853.520304][T25443] _copy_to_user+0x31/0xb0 [ 1853.520323][T25443] simple_read_from_buffer+0xe1/0x170 [ 1853.520349][T25443] proc_fail_nth_read+0x1df/0x250 [ 1853.520374][T25443] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1853.520398][T25443] ? rw_verify_area+0x258/0x650 [ 1853.520423][T25443] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1853.520445][T25443] vfs_read+0x200/0x980 [ 1853.520475][T25443] ? __pfx___mutex_lock+0x10/0x10 [ 1853.520501][T25443] ? __pfx_vfs_read+0x10/0x10 [ 1853.520528][T25443] ? __fget_files+0x2a/0x420 [ 1853.520552][T25443] ? __fget_files+0x3a0/0x420 [ 1853.520570][T25443] ? __fget_files+0x2a/0x420 [ 1853.520598][T25443] ksys_read+0x145/0x250 [ 1853.520625][T25443] ? __pfx_ksys_read+0x10/0x10 [ 1853.520647][T25443] ? rcu_is_watching+0x15/0xb0 [ 1853.520680][T25443] ? do_syscall_64+0xbe/0x3b0 [ 1853.520709][T25443] do_syscall_64+0xfa/0x3b0 [ 1853.520732][T25443] ? lockdep_hardirqs_on+0x9c/0x150 [ 1853.520755][T25443] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1853.520781][T25443] ? clear_bhb_loop+0x60/0xb0 [ 1853.520804][T25443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1853.520821][T25443] RIP: 0033:0x7faaf518d33c [ 1853.520838][T25443] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1853.520853][T25443] RSP: 002b:00007faaf60af030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1853.520872][T25443] RAX: ffffffffffffffda RBX: 00007faaf53b5fa0 RCX: 00007faaf518d33c [ 1853.520886][T25443] RDX: 000000000000000f RSI: 00007faaf60af0a0 RDI: 0000000000000006 [ 1853.520898][T25443] RBP: 00007faaf60af090 R08: 0000000000000000 R09: 0000000000000000 [ 1853.520910][T25443] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1853.520921][T25443] R13: 0000000000000000 R14: 00007faaf53b5fa0 R15: 00007faaf54dfa28 [ 1853.520951][T25443] [ 1854.062133][ T5835] usb 4-1: reset high-speed USB device number 83 using dummy_hcd [ 1854.412566][ T5908] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 1854.627480][T22988] usb 3-1: USB disconnect, device number 89 [ 1854.782744][ T5908] usb 2-1: config 0 has no interfaces? [ 1854.826491][ T5908] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1854.847281][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1855.161038][ T5908] usb 2-1: Product: syz [ 1855.177054][ T5908] usb 2-1: Manufacturer: syz [ 1855.352203][ T5934] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 1855.416929][ T5908] usb 2-1: SerialNumber: syz [ 1855.503885][ T5908] usb 2-1: config 0 descriptor?? [ 1855.538904][ T5934] usb 3-1: Using ep0 maxpacket: 8 [ 1855.571136][ T5934] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1855.639630][ T5934] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1855.746456][ T5934] usb 3-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=bc.76 [ 1855.862243][ T977] usb 1-1: USB disconnect, device number 91 [ 1855.869396][ T5934] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1855.885685][ T5934] usb 3-1: Product: syz [ 1855.892854][ T5934] usb 3-1: Manufacturer: syz [ 1855.898688][ T5934] usb 3-1: SerialNumber: syz [ 1855.909749][ T5934] usb 3-1: config 0 descriptor?? [ 1855.918518][ T5934] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 found [ 1856.095799][T14007] usb 4-1: USB disconnect, device number 83 [ 1856.122433][ T5934] snd_usb_toneport 3-1:0.0: cannot get proper max packet size [ 1856.133732][ T5934] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 now disconnected [ 1856.199280][ T5934] snd_usb_toneport 3-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 1857.322071][T14007] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 1857.533247][T14007] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1857.612096][T14007] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1857.683907][T14007] usb 1-1: config 0 descriptor?? [ 1857.777295][ T5908] usb 2-1: USB disconnect, device number 94 [ 1857.902360][T22988] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1858.414384][T22988] usb 4-1: config 0 has no interfaces? [ 1858.512978][T25480] FAULT_INJECTION: forcing a failure. [ 1858.512978][T25480] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1858.539652][T22988] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1858.682298][T22988] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1858.752250][T25480] CPU: 0 UID: 0 PID: 25480 Comm: syz.1.4297 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1858.752278][T25480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1858.752289][T25480] Call Trace: [ 1858.752297][T25480] [ 1858.752306][T25480] dump_stack_lvl+0x189/0x250 [ 1858.752336][T25480] ? __pfx____ratelimit+0x10/0x10 [ 1858.752361][T25480] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1858.752385][T25480] ? __pfx__printk+0x10/0x10 [ 1858.752405][T25480] ? __might_fault+0xb0/0x130 [ 1858.752431][T25480] should_fail_ex+0x414/0x560 [ 1858.752458][T25480] _copy_from_iter+0x1db/0x16f0 [ 1858.752486][T25480] ? sock_alloc_send_pskb+0x875/0x990 [ 1858.752515][T25480] ? __pfx__copy_from_iter+0x10/0x10 [ 1858.752547][T25480] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 1858.752572][T25480] skb_copy_datagram_from_iter+0xf5/0x720 [ 1858.752598][T25480] ? __asan_memcpy+0x40/0x70 [ 1858.752622][T25480] ? eth_header+0x11b/0x200 [ 1858.752778][T25480] packet_sendmsg+0x3abb/0x53f0 [ 1858.752862][T25480] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1858.752901][T25480] ? __pfx___might_resched+0x10/0x10 [ 1858.752925][T25480] ? __lock_acquire+0xab9/0xd20 [ 1858.752962][T25480] ? __pfx_packet_sendmsg+0x10/0x10 [ 1858.752980][T25480] ? aa_sk_perm+0x81e/0x950 [ 1858.753007][T25480] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 1858.753036][T25480] ? aa_sock_msg_perm+0x94/0x160 [ 1858.753060][T25480] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1858.753081][T25480] ? __pfx_packet_sendmsg+0x10/0x10 [ 1858.753103][T25480] __sock_sendmsg+0x219/0x270 [ 1858.753131][T25480] __sys_sendto+0x3bd/0x520 [ 1858.753152][T25480] ? __pfx___sys_sendto+0x10/0x10 [ 1858.753168][T25480] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 1858.753206][T25480] ? __fget_files+0x3a0/0x420 [ 1858.753235][T25480] ? ksys_write+0x22a/0x250 [ 1858.753254][T25480] ? __pfx_ksys_write+0x10/0x10 [ 1858.753268][T25480] ? rcu_is_watching+0x15/0xb0 [ 1858.753298][T25480] __x64_sys_sendto+0xde/0x100 [ 1858.753321][T25480] do_syscall_64+0xfa/0x3b0 [ 1858.753343][T25480] ? lockdep_hardirqs_on+0x9c/0x150 [ 1858.753366][T25480] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1858.753383][T25480] ? clear_bhb_loop+0x60/0xb0 [ 1858.753405][T25480] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1858.753422][T25480] RIP: 0033:0x7ff39c98e929 [ 1858.753438][T25480] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1858.753453][T25480] RSP: 002b:00007ff39d710038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1858.753472][T25480] RAX: ffffffffffffffda RBX: 00007ff39cbb5fa0 RCX: 00007ff39c98e929 [ 1858.753486][T25480] RDX: 0000000000000009 RSI: 0000000000000000 RDI: 0000000000000003 [ 1858.753495][T25480] RBP: 00007ff39d710090 R08: 0000200000000200 R09: 0000000000000014 [ 1858.753507][T25480] R10: 0000000020000844 R11: 0000000000000246 R12: 0000000000000001 [ 1858.753539][T25480] R13: 0000000000000000 R14: 00007ff39cbb5fa0 R15: 00007ff39ccdfa28 [ 1858.753566][T25480] [ 1858.815559][T14007] ath6kl: Failed to submit usb control message: -110 [ 1859.100292][T22988] usb 4-1: Product: syz [ 1859.162065][T22988] usb 4-1: Manufacturer: syz [ 1859.166705][T22988] usb 4-1: SerialNumber: syz [ 1859.493277][T22988] usb 4-1: config 0 descriptor?? [ 1859.551276][T14007] ath6kl: unable to send the bmi data to the device: -110 [ 1859.564300][T14007] ath6kl: Unable to send get target info: -110 [ 1859.594105][T14007] ath6kl: Failed to init ath6kl core: -110 [ 1859.600703][T14007] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1860.608012][ T5934] usb 3-1: USB disconnect, device number 90 [ 1861.507582][T25499] netlink: 'syz.5.4303': attribute type 10 has an invalid length. [ 1861.552441][ T5934] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 1861.680798][T25499] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4303'. [ 1861.728030][T14007] usb 4-1: USB disconnect, device number 84 [ 1861.809108][T25499] geneve0: entered promiscuous mode [ 1861.838209][T25499] team0: Port device geneve0 added [ 1861.852202][ T5934] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 127, changing to 10 [ 1861.879040][ T5835] usb 1-1: USB disconnect, device number 92 [ 1861.891225][ T5934] usb 3-1: New USB device found, idVendor=0c70, idProduct=f0bd, bcdDevice= 0.00 [ 1861.946360][ T5934] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1861.984129][ T5934] usb 3-1: config 0 descriptor?? [ 1862.392289][T22988] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1862.434009][ T5934] aquacomputer_d5next 0003:0C70:F0BD.001E: hidraw0: USB HID v0.00 Device [HID 0c70:f0bd] on usb-dummy_hcd.2-1/input0 [ 1862.657668][ T5835] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 1862.705805][T25495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1862.735618][T25495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1862.743783][T22988] usb 6-1: Using ep0 maxpacket: 16 [ 1862.785616][T22988] usb 6-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4 [ 1862.832169][T22988] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1862.854048][ T5835] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1862.876673][ T5835] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1862.882335][T22988] usb 6-1: Product: syz [ 1862.912197][T14007] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 1862.929981][T22988] usb 6-1: Manufacturer: syz [ 1862.951782][ T5835] usb 2-1: config 0 descriptor?? [ 1862.982462][T22988] usb 6-1: SerialNumber: syz [ 1862.983313][ T5934] usb 3-1: USB disconnect, device number 91 [ 1863.019667][T25525] fido_id[25525]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 1863.045559][T22988] usb 6-1: config 0 descriptor?? [ 1863.094590][T22988] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state. [ 1863.234714][T14007] usb 1-1: config 0 has no interfaces? [ 1863.272388][T22988] gp8psk: usb in 128 operation failed. [ 1863.421077][T22988] gp8psk: usb in 137 operation failed. [ 1863.426839][T22988] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1863.437395][T22988] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver) [ 1863.449559][T14007] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1863.465203][T22988] usb 6-1: media controller created [ 1863.502072][T14007] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1863.531841][T22988] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1863.574140][T14007] usb 1-1: Product: syz [ 1863.598696][T14007] usb 1-1: Manufacturer: syz [ 1863.637534][T14007] usb 1-1: SerialNumber: syz [ 1863.644166][T22988] gp8psk_fe: Frontend revision 1 attached [ 1863.687796][T14007] usb 1-1: config 0 descriptor?? [ 1863.696166][T22988] usb 6-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 1863.779880][T22988] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 1864.082686][ T5835] ath6kl: Failed to submit usb control message: -110 [ 1864.089515][ T5835] ath6kl: unable to send the bmi data to the device: -110 [ 1864.166806][T22988] gp8psk: usb in 138 operation failed. [ 1864.171999][ T5835] ath6kl: Unable to send get target info: -110 [ 1864.202042][ T5835] ath6kl: Failed to init ath6kl core: -110 [ 1864.212816][ T5835] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1864.317836][T22988] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected. [ 1864.336132][T22988] gp8psk: found Genpix USB device pID = 201 (hex) [ 1864.347684][T22988] usb 6-1: USB disconnect, device number 32 [ 1864.504647][T25534] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4311'. [ 1865.033373][T22988] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected. [ 1865.280758][T25546] netlink: 'syz.2.4314': attribute type 4 has an invalid length. [ 1865.480473][ T5934] usb 1-1: USB disconnect, device number 93 [ 1865.599610][T25546] netlink: 152 bytes leftover after parsing attributes in process `syz.2.4314'. [ 1866.041408][T25546] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1866.121460][ T5908] usb 2-1: USB disconnect, device number 95 [ 1866.222084][ T5934] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 1866.293648][T25552] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4316'. [ 1866.298061][T25554] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 1866.323404][T25554] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 1866.402148][ T5934] usb 1-1: Using ep0 maxpacket: 16 [ 1866.416121][ T5934] usb 1-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4 [ 1866.427679][ T5934] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1866.453902][T25552] bond_slave_1: entered promiscuous mode [ 1866.477410][ T5934] usb 1-1: Product: syz [ 1866.493009][ T5934] usb 1-1: Manufacturer: syz [ 1866.508018][ T5934] usb 1-1: SerialNumber: syz [ 1866.533722][ T5934] usb 1-1: config 0 descriptor?? [ 1866.550027][ T5934] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state. [ 1866.751566][ T5934] gp8psk: usb in 128 operation failed. [ 1866.756793][T25557] FAULT_INJECTION: forcing a failure. [ 1866.756793][T25557] name failslab, interval 1, probability 0, space 0, times 0 [ 1866.774786][T25557] CPU: 0 UID: 0 PID: 25557 Comm: syz.2.4318 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1866.774811][T25557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1866.774822][T25557] Call Trace: [ 1866.774830][T25557] [ 1866.774838][T25557] dump_stack_lvl+0x189/0x250 [ 1866.774871][T25557] ? __pfx____ratelimit+0x10/0x10 [ 1866.774898][T25557] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1866.774923][T25557] ? __pfx__printk+0x10/0x10 [ 1866.774948][T25557] ? __pfx___might_resched+0x10/0x10 [ 1866.774971][T25557] ? fs_reclaim_acquire+0x7d/0x100 [ 1866.774999][T25557] should_fail_ex+0x414/0x560 [ 1866.775025][T25557] should_failslab+0xa8/0x100 [ 1866.775054][T25557] __kmalloc_noprof+0xcb/0x4f0 [ 1866.775069][T25557] ? kfree+0x4d/0x440 [ 1866.775090][T25557] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1866.775119][T25557] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1866.775145][T25557] ? tomoyo_domain+0xd9/0x130 [ 1866.775175][T25557] tomoyo_path2_perm+0x265/0x680 [ 1866.775195][T25557] ? tomoyo_path2_perm+0x235/0x680 [ 1866.775217][T25557] ? __pfx_tomoyo_path2_perm+0x10/0x10 [ 1866.775286][T25557] tomoyo_path_rename+0x141/0x190 [ 1866.775310][T25557] ? __d_lookup+0x66/0x780 [ 1866.775334][T25557] ? __pfx_tomoyo_path_rename+0x10/0x10 [ 1866.775372][T25557] security_path_rename+0x250/0x490 [ 1866.775487][T25557] do_renameat2+0x64d/0xc50 [ 1866.775522][T25557] ? __pfx_do_renameat2+0x10/0x10 [ 1866.775556][T25557] ? getname_flags+0x1e5/0x540 [ 1866.775580][T25557] __x64_sys_renameat2+0xce/0xe0 [ 1866.775602][T25557] do_syscall_64+0xfa/0x3b0 [ 1866.775626][T25557] ? lockdep_hardirqs_on+0x9c/0x150 [ 1866.775649][T25557] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1866.775668][T25557] ? clear_bhb_loop+0x60/0xb0 [ 1866.775689][T25557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1866.775708][T25557] RIP: 0033:0x7fa1c8b8e929 [ 1866.775722][T25557] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1866.775738][T25557] RSP: 002b:00007fa1c69f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 1866.775757][T25557] RAX: ffffffffffffffda RBX: 00007fa1c8db5fa0 RCX: 00007fa1c8b8e929 [ 1866.775771][T25557] RDX: ffffffffffffff9c RSI: 00002000000008c0 RDI: ffffffffffffff9c [ 1866.775784][T25557] RBP: 00007fa1c69f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1866.775794][T25557] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000001 [ 1866.775804][T25557] R13: 0000000000000000 R14: 00007fa1c8db5fa0 R15: 00007fa1c8edfa28 [ 1866.775834][T25557] [ 1866.776199][T25557] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1866.879479][ T5934] gp8psk: usb in 137 operation failed. [ 1867.043633][T25550] bond_slave_1: left promiscuous mode [ 1867.049555][ T5934] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1867.062691][ T5934] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver) [ 1867.084466][ T5934] usb 1-1: media controller created [ 1867.221239][ T5934] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1867.271324][ T5934] gp8psk_fe: Frontend revision 1 attached [ 1867.342322][ T5934] usb 1-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 1867.350597][ T5934] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 1867.432657][T25572] netlink: 'syz.2.4323': attribute type 3 has an invalid length. [ 1867.479404][ T5934] gp8psk: usb in 138 operation failed. [ 1867.493337][ T5934] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected. [ 1867.504362][ T5934] gp8psk: found Genpix USB device pID = 201 (hex) [ 1867.542381][ T5934] usb 1-1: USB disconnect, device number 94 [ 1867.692731][T22988] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1867.806245][ T5934] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected. [ 1867.923559][T22988] usb 4-1: Using ep0 maxpacket: 32 [ 1867.939813][T22988] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1867.953294][T22988] usb 4-1: config 251 has an invalid descriptor of length 0, skipping remainder of the config [ 1867.967616][T22988] usb 4-1: New USB device found, idVendor=0bfd, idProduct=0106, bcdDevice=20.39 [ 1867.977670][T22988] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1867.994202][T22988] usb 4-1: Product: syz [ 1868.007814][T22988] usb 4-1: Manufacturer: syz [ 1868.072382][T22988] usb 4-1: SerialNumber: syz [ 1868.153967][ T5934] usb 1-1: new full-speed USB device number 95 using dummy_hcd [ 1868.504976][T22988] kvaser_usb 4-1:251.0: error -ENODEV: Cannot get usb endpoint(s) [ 1868.644611][T22988] usb 4-1: USB disconnect, device number 85 [ 1868.774594][ T5934] usb 1-1: config 0 has no interfaces? [ 1868.922066][ T5934] usb 1-1: New USB device found, idVendor=067b, idProduct=0611, bcdDevice=ee.60 [ 1869.463836][ T5934] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1869.492151][ T5934] usb 1-1: Product: syz [ 1869.515501][ T5934] usb 1-1: Manufacturer: syz [ 1869.537958][ T5934] usb 1-1: SerialNumber: syz [ 1869.566326][ T5934] usb 1-1: config 0 descriptor?? [ 1869.951036][T25600] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4332'. [ 1870.022469][ T5908] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1870.050633][T25607] ======================================================= [ 1870.050633][T25607] WARNING: The mand mount option has been deprecated and [ 1870.050633][T25607] and is ignored by this kernel. Remove the mand [ 1870.050633][T25607] option from the mount to silence this warning. [ 1870.050633][T25607] ======================================================= [ 1870.175890][ T5908] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1870.192525][ T5908] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1870.205502][ T5908] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1870.219602][ T5908] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1870.228085][ T5908] usb 3-1: SerialNumber: syz [ 1870.272090][T22988] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1870.432190][T22988] usb 6-1: Using ep0 maxpacket: 8 [ 1870.441356][T22988] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 1870.459229][ T5908] usb 3-1: 0:2 : does not exist [ 1870.467270][T22988] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.00 [ 1870.483793][ T5908] usb 3-1: USB disconnect, device number 92 [ 1870.489888][T22988] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1870.505108][T22988] usb 6-1: config 0 descriptor?? [ 1870.531934][ T7261] udevd[7261]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1870.931069][T22988] corsair 0003:1B1C:1B09.001F: unbalanced delimiter at end of report description [ 1870.947624][T22988] corsair 0003:1B1C:1B09.001F: parse failed [ 1870.954211][T22988] corsair 0003:1B1C:1B09.001F: probe with driver corsair failed with error -22 [ 1871.177075][T22988] usb 6-1: USB disconnect, device number 33 [ 1871.612550][T14007] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1871.772743][T14007] usb 4-1: Using ep0 maxpacket: 32 [ 1871.783136][T14007] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 1871.791688][T14007] usb 4-1: config 0 has no interface number 0 [ 1871.800613][T14007] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1871.810176][T14007] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1871.818408][T14007] usb 4-1: Product: syz [ 1871.822824][T14007] usb 4-1: Manufacturer: syz [ 1871.827568][T14007] usb 4-1: SerialNumber: syz [ 1871.909305][T14007] usb 4-1: config 0 descriptor?? [ 1871.921351][T14007] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1872.163550][T22988] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 1872.173656][ T5908] usb 1-1: USB disconnect, device number 95 [ 1872.236884][T14007] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1872.464232][T14007] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1872.486923][T22988] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1872.513122][T22988] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1872.593302][T22988] usb 2-1: config 0 descriptor?? [ 1872.702061][ T5915] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1872.842025][T14007] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 1873.000400][ T5915] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1873.009162][ T5915] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1873.021929][ T5915] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1873.031430][ T5915] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1873.042843][ T5915] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1873.056563][ T5915] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1873.067403][ T5915] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1873.075858][ T5915] usb 3-1: Product: syz [ 1873.084308][ T5915] usb 3-1: Manufacturer: syz [ 1873.097130][ T5915] cdc_wdm 3-1:1.0: skipping garbage [ 1873.102486][ T5915] cdc_wdm 3-1:1.0: skipping garbage [ 1873.116518][ T5915] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 1873.122698][ T5915] cdc_wdm 3-1:1.0: Unknown control protocol [ 1873.144195][T14007] usb 1-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 1873.153447][T14007] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1873.170034][T14007] usb 1-1: config 0 descriptor?? [ 1873.532076][ T5915] usb 6-1: new full-speed USB device number 34 using dummy_hcd [ 1873.686787][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -EPIPE [ 1873.692115][T22988] ath6kl: Failed to submit usb control message: -110 [ 1873.697022][ T5915] usb 6-1: not running at top speed; connect to a high speed hub [ 1873.700658][T22988] ath6kl: unable to send the bmi data to the device: -110 [ 1873.727179][ T5915] usb 6-1: config 1 has an invalid descriptor of length 249, skipping remainder of the config [ 1873.743422][ T5915] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1873.759000][ T5915] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1873.771208][ T5915] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1873.783726][ T5915] usb 6-1: Product: К [ 1873.787950][ T5915] usb 6-1: Manufacturer: Б [ 1873.795594][ T5915] usb 6-1: SerialNumber: ю [ 1873.886854][T25639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1873.907442][T25639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1873.938283][ T5835] usb 3-1: USB disconnect, device number 93 [ 1874.045285][ T5915] usb 6-1: 0:2 : does not exist [ 1874.093375][ T5915] usb 6-1: USB disconnect, device number 34 [ 1874.188145][ T7261] udevd[7261]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1874.503765][T25642] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1874.575767][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1874.583965][ T5934] usb 4-1: USB disconnect, device number 86 [ 1874.604602][T25642] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1874.659354][ T5934] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1874.689937][T14007] pegasus 1-1:0.0: can't reset MAC [ 1874.724053][T14007] pegasus 1-1:0.0: probe with driver pegasus failed with error -5 [ 1874.796521][ T5934] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1874.866237][T22988] ath6kl: Unable to send get target info: -110 [ 1874.880922][T22988] ath6kl: Failed to init ath6kl core: -110 [ 1874.888218][T22988] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1874.902139][T14007] usb 1-1: USB disconnect, device number 96 [ 1874.968380][ T5934] quatech2 4-1:0.51: device disconnected [ 1874.977320][ T5835] usb 2-1: USB disconnect, device number 96 [ 1874.990621][ T30] audit: type=1326 audit(1751197930.775:8422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.076720][ T30] audit: type=1326 audit(1751197930.815:8423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=103 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.108415][ T30] audit: type=1326 audit(1751197930.815:8424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.139788][ T30] audit: type=1326 audit(1751197930.815:8425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.292051][ T30] audit: type=1326 audit(1751197930.815:8426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.350472][T25667] binder: 25666:25667 ioctl 40046205 0 returned -22 [ 1875.371420][ T30] audit: type=1326 audit(1751197930.815:8427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.450741][ T30] audit: type=1326 audit(1751197930.815:8428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.473766][T22988] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1875.495008][T25667] Cannot find del_set index 2 as target [ 1875.496080][ T30] audit: type=1326 audit(1751197930.825:8429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.552482][ T30] audit: type=1326 audit(1751197930.825:8430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.602282][ T30] audit: type=1326 audit(1751197930.825:8431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25656 comm="syz.3.4348" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1875.681725][T22988] usb 6-1: config 0 has no interfaces? [ 1875.699168][T22988] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1875.770314][T22988] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1875.790113][T22988] usb 6-1: Product: syz [ 1875.800157][T22988] usb 6-1: Manufacturer: syz [ 1875.812097][T14007] usb 3-1: new full-speed USB device number 94 using dummy_hcd [ 1875.815935][T22988] usb 6-1: SerialNumber: syz [ 1875.860028][T22988] usb 6-1: config 0 descriptor?? [ 1875.964115][T14007] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1876.072562][T14007] usb 3-1: not running at top speed; connect to a high speed hub [ 1876.099839][T25665] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4349'. [ 1876.121556][T14007] usb 3-1: config 3 has an invalid interface number: 106 but max is 0 [ 1876.132103][T14007] usb 3-1: config 3 has no interface number 0 [ 1876.147493][T14007] usb 3-1: config 3 interface 106 altsetting 10 endpoint 0xD has invalid maxpacket 512, setting to 64 [ 1876.159549][T14007] usb 3-1: config 3 interface 106 altsetting 10 endpoint 0xF has invalid maxpacket 1024, setting to 64 [ 1876.225232][T14007] usb 3-1: config 3 interface 106 has no altsetting 0 [ 1876.241639][T14007] usb 3-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice=e8.8a [ 1876.253505][T14007] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1876.269049][T14007] usb 3-1: Product: syz [ 1876.296901][T14007] usb 3-1: Manufacturer: syz [ 1876.627107][T14007] usb 3-1: SerialNumber: syz [ 1876.662877][T25674] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1876.670358][T25674] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1876.922149][T14007] kobil_sct 3-1:3.106: KOBIL USB smart card terminal converter detected [ 1876.965433][T14007] usb 3-1: KOBIL USB smart card terminal converter now attached to ttyUSB0 [ 1876.997084][T14007] usb 3-1: USB disconnect, device number 94 [ 1877.058555][T14007] kobil ttyUSB0: KOBIL USB smart card terminal converter now disconnected from ttyUSB0 [ 1877.434135][T14007] kobil_sct 3-1:3.106: device disconnected [ 1877.642145][ T5934] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 1877.687340][T25699] bridge9: entered promiscuous mode [ 1877.772360][ T5908] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 1877.835234][ T5934] usb 1-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 1877.870415][ T5934] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1877.919366][ T5934] usb 1-1: Product: syz [ 1877.933888][ T5908] usb 2-1: Using ep0 maxpacket: 16 [ 1877.946098][ T5908] usb 2-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4 [ 1877.956771][ T5908] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1877.969821][ T5934] usb 1-1: Manufacturer: syz [ 1877.982588][ T5908] usb 2-1: Product: syz [ 1877.986922][ T5908] usb 2-1: Manufacturer: syz [ 1877.993996][ T5908] usb 2-1: SerialNumber: syz [ 1877.998385][ T5934] usb 1-1: SerialNumber: syz [ 1878.022927][ T5934] usb 1-1: config 0 descriptor?? [ 1878.023044][ T5908] usb 2-1: config 0 descriptor?? [ 1878.044943][ T5908] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state. [ 1878.245666][T25690] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1878.256709][T25690] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1878.270091][ T5908] gp8psk: usb in 128 operation failed. [ 1878.656024][ T5908] gp8psk: usb in 146 operation failed. [ 1878.664431][ T5908] gp8psk: failed to get FW version [ 1878.671445][ T5908] gp8psk: usb in 149 operation failed. [ 1878.686260][ T5908] gp8psk: failed to get FPGA version [ 1878.700809][T22988] usb 6-1: USB disconnect, device number 35 [ 1878.710110][ T5900] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1878.836917][ T5908] usb 2-1: Direct firmware load for dvb-usb-gp8psk-02.fw failed with error -2 [ 1878.852452][ T5908] usb 2-1: Falling back to sysfs fallback for: dvb-usb-gp8psk-02.fw [ 1878.918806][T25709] FAULT_INJECTION: forcing a failure. [ 1878.918806][T25709] name failslab, interval 1, probability 0, space 0, times 0 [ 1878.949277][T25709] CPU: 0 UID: 0 PID: 25709 Comm: syz.5.4363 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1878.949303][T25709] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1878.949316][T25709] Call Trace: [ 1878.949324][T25709] [ 1878.949333][T25709] dump_stack_lvl+0x189/0x250 [ 1878.949364][T25709] ? __pfx____ratelimit+0x10/0x10 [ 1878.949389][T25709] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1878.949415][T25709] ? __pfx__printk+0x10/0x10 [ 1878.949440][T25709] ? __pfx___might_resched+0x10/0x10 [ 1878.949465][T25709] ? fs_reclaim_acquire+0x7d/0x100 [ 1878.949492][T25709] should_fail_ex+0x414/0x560 [ 1878.949519][T25709] should_failslab+0xa8/0x100 [ 1878.949541][T25709] __kmalloc_noprof+0xcb/0x4f0 [ 1878.949557][T25709] ? kfree+0x4d/0x440 [ 1878.949579][T25709] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1878.949609][T25709] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1878.949647][T25709] tomoyo_path2_perm+0x288/0x680 [ 1878.949669][T25709] ? tomoyo_path2_perm+0x235/0x680 [ 1878.949691][T25709] ? __pfx_tomoyo_path2_perm+0x10/0x10 [ 1878.949726][T25709] ? register_lock_class+0x51/0x320 [ 1878.949785][T25709] tomoyo_path_rename+0x141/0x190 [ 1878.949814][T25709] ? __pfx_tomoyo_path_rename+0x10/0x10 [ 1878.949858][T25709] security_path_rename+0x250/0x490 [ 1878.949889][T25709] do_renameat2+0x64d/0xc50 [ 1878.949930][T25709] ? __pfx_do_renameat2+0x10/0x10 [ 1878.949965][T25709] ? getname_flags+0x1e5/0x540 [ 1878.949990][T25709] __x64_sys_renameat2+0xce/0xe0 [ 1878.950013][T25709] do_syscall_64+0xfa/0x3b0 [ 1878.950037][T25709] ? lockdep_hardirqs_on+0x9c/0x150 [ 1878.950061][T25709] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1878.950079][T25709] ? clear_bhb_loop+0x60/0xb0 [ 1878.950100][T25709] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1878.950119][T25709] RIP: 0033:0x7faaf518e929 [ 1878.950135][T25709] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1878.950151][T25709] RSP: 002b:00007faaf60af038 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 1878.950175][T25709] RAX: ffffffffffffffda RBX: 00007faaf53b5fa0 RCX: 00007faaf518e929 [ 1878.950189][T25709] RDX: ffffffffffffff9c RSI: 00002000000008c0 RDI: ffffffffffffff9c [ 1878.950203][T25709] RBP: 00007faaf60af090 R08: 0000000000000000 R09: 0000000000000000 [ 1878.950215][T25709] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000001 [ 1878.950227][T25709] R13: 0000000000000000 R14: 00007faaf53b5fa0 R15: 00007faaf54dfa28 [ 1878.950257][T25709] [ 1878.950433][T25709] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1879.239626][ T5900] usb 3-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 1879.249342][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1879.257609][ T5900] usb 3-1: Product: syz [ 1879.261894][ T5900] usb 3-1: Manufacturer: syz [ 1879.266806][ T5900] usb 3-1: SerialNumber: syz [ 1879.276685][ T5900] usb 3-1: config 0 descriptor?? [ 1879.371565][T25711] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4364'. [ 1879.517963][T25711] hsr_slave_1 (unregistering): left promiscuous mode [ 1879.621157][T25705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1879.631284][T25705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1880.045312][ T5934] usb 1-1: f81604_read: reg: 105 failed: -EPROTO [ 1880.070130][ T5934] f81604 1-1:0.0: Setting termination of CH#0 failed: -EPROTO [ 1880.081354][ T5934] f81604 1-1:0.0: probe with driver f81604 failed with error -71 [ 1880.103227][ T5934] usb 1-1: USB disconnect, device number 97 [ 1880.306322][T25725] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4368'. [ 1880.322576][T25725] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4368'. [ 1881.313750][ T5900] usb 3-1: f81604_read: reg: 105 failed: -EPROTO [ 1881.323778][ T5900] f81604 3-1:0.0: Setting termination of CH#0 failed: -EPROTO [ 1881.334900][ T5900] f81604 3-1:0.0: probe with driver f81604 failed with error -71 [ 1881.405821][ T5900] usb 3-1: USB disconnect, device number 95 [ 1881.472183][T19607] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1881.566165][T25735] netlink: 'syz.2.4370': attribute type 1 has an invalid length. [ 1881.582305][T22988] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1881.709818][T25736] bond2: (slave bridge3): Enslaving as a backup interface with an up link [ 1881.862039][T22988] usb 4-1: Using ep0 maxpacket: 16 [ 1881.877806][T19607] usb 6-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 1881.889616][T22988] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1881.902396][T19607] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1881.910371][T19607] usb 6-1: Product: syz [ 1881.918580][T22988] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1881.939826][T19607] usb 6-1: Manufacturer: syz [ 1881.967090][T22988] usb 4-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 1881.977255][T19607] usb 6-1: SerialNumber: syz [ 1882.005472][T22988] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1882.014626][T19607] usb 6-1: config 0 descriptor?? [ 1882.054006][T22988] usb 4-1: config 0 descriptor?? [ 1882.062438][ T5934] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1882.092700][ T5915] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 1882.212120][ T5934] usb 3-1: device descriptor read/64, error -71 [ 1882.252709][ T5915] usb 1-1: Using ep0 maxpacket: 16 [ 1882.261700][ T5915] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1882.289164][ T5915] usb 1-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 1882.298843][ T5915] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1882.369749][ T5915] usb 1-1: Product: syz [ 1882.374292][ T5915] usb 1-1: Manufacturer: syz [ 1882.379216][ T5915] usb 1-1: SerialNumber: syz [ 1882.400469][ T5915] usb 1-1: config 0 descriptor?? [ 1882.415045][ T5915] hub 1-1:0.0: bad descriptor, ignoring hub [ 1882.424138][T25722] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1882.433983][T25722] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1882.450686][ T5915] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1882.460807][ T5915] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1882.502827][ T5934] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 1882.527432][ T5915] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1882.544272][ T5848] udevd[5848]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1882.545372][T22988] hid-multitouch 0003:1FD2:6007.0020: hidraw0: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.3-1/input0 [ 1882.643456][ T5934] usb 3-1: device descriptor read/64, error -71 [ 1882.669542][T25729] FAULT_INJECTION: forcing a failure. [ 1882.669542][T25729] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1882.695534][T25729] CPU: 0 UID: 0 PID: 25729 Comm: syz.3.4369 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1882.695552][T25729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1882.695559][T25729] Call Trace: [ 1882.695564][T25729] [ 1882.695569][T25729] dump_stack_lvl+0x189/0x250 [ 1882.695592][T25729] ? __pfx____ratelimit+0x10/0x10 [ 1882.695607][T25729] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1882.695621][T25729] ? __pfx__printk+0x10/0x10 [ 1882.695639][T25729] should_fail_ex+0x414/0x560 [ 1882.695655][T25729] strncpy_from_user+0x36/0x290 [ 1882.695669][T25729] getname_flags+0xf3/0x540 [ 1882.695683][T25729] do_sys_openat2+0xbc/0x1c0 [ 1882.695697][T25729] ? __pfx_do_sys_openat2+0x10/0x10 [ 1882.695717][T25729] ? ksys_write+0x22a/0x250 [ 1882.695728][T25729] ? __pfx_ksys_write+0x10/0x10 [ 1882.695735][T25729] ? rcu_is_watching+0x15/0xb0 [ 1882.695753][T25729] __x64_sys_openat+0x138/0x170 [ 1882.695768][T25729] do_syscall_64+0xfa/0x3b0 [ 1882.695781][T25729] ? lockdep_hardirqs_on+0x9c/0x150 [ 1882.695794][T25729] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1882.695809][T25729] ? clear_bhb_loop+0x60/0xb0 [ 1882.695821][T25729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1882.695831][T25729] RIP: 0033:0x7f3b6658d290 [ 1882.695841][T25729] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 [ 1882.695849][T25729] RSP: 002b:00007f3b6749fb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 1882.695861][T25729] RAX: ffffffffffffffda RBX: 000000000014a042 RCX: 00007f3b6658d290 [ 1882.695869][T25729] RDX: 000000000014a042 RSI: 00007f3b6749fc10 RDI: 00000000ffffff9c [ 1882.695875][T25729] RBP: 00007f3b6749fc10 R08: 0000000000000000 R09: 0023776172646968 [ 1882.695882][T25729] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 1882.695889][T25729] R13: 0000000000000000 R14: 00007f3b667b5fa0 R15: 00007f3b668dfa28 [ 1882.695904][T25729] [ 1882.723031][ T5915] usb 1-1: USB disconnect, device number 98 [ 1882.724895][T22988] usb 4-1: USB disconnect, device number 87 [ 1882.762401][ T5934] usb usb3-port1: attempt power cycle [ 1882.951056][T25741] fido_id[25741]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 1883.011095][T25743] FAULT_INJECTION: forcing a failure. [ 1883.011095][T25743] name failslab, interval 1, probability 0, space 0, times 0 [ 1883.028835][T25743] CPU: 0 UID: 0 PID: 25743 Comm: syz.1.4372 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1883.028852][T25743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1883.028859][T25743] Call Trace: [ 1883.028864][T25743] [ 1883.028869][T25743] dump_stack_lvl+0x189/0x250 [ 1883.028890][T25743] ? __pfx____ratelimit+0x10/0x10 [ 1883.028905][T25743] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1883.028920][T25743] ? __pfx__printk+0x10/0x10 [ 1883.028934][T25743] ? ref_tracker_alloc+0x318/0x460 [ 1883.028952][T25743] should_fail_ex+0x414/0x560 [ 1883.028967][T25743] should_failslab+0xa8/0x100 [ 1883.028980][T25743] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1883.028995][T25743] ? skb_clone+0x212/0x3a0 [ 1883.029012][T25743] skb_clone+0x212/0x3a0 [ 1883.029026][T25743] __netlink_deliver_tap+0x404/0x850 [ 1883.029045][T25743] ? netlink_deliver_tap+0x2e/0x1b0 [ 1883.029056][T25743] netlink_deliver_tap+0x19c/0x1b0 [ 1883.029068][T25743] netlink_unicast+0x72f/0x8d0 [ 1883.029083][T25743] netlink_sendmsg+0x805/0xb30 [ 1883.029098][T25743] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1883.029111][T25743] ? aa_sock_msg_perm+0x94/0x160 [ 1883.029125][T25743] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1883.029138][T25743] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1883.029149][T25743] __sock_sendmsg+0x219/0x270 [ 1883.029165][T25743] ____sys_sendmsg+0x505/0x830 [ 1883.029180][T25743] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1883.029196][T25743] ? import_iovec+0x74/0xa0 [ 1883.029208][T25743] ___sys_sendmsg+0x21f/0x2a0 [ 1883.029221][T25743] ? __pfx____sys_sendmsg+0x10/0x10 [ 1883.029251][T25743] ? __fget_files+0x2a/0x420 [ 1883.029262][T25743] ? __fget_files+0x3a0/0x420 [ 1883.029278][T25743] __x64_sys_sendmsg+0x19b/0x260 [ 1883.029291][T25743] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1883.029307][T25743] ? __pfx_ksys_write+0x10/0x10 [ 1883.029315][T25743] ? rcu_is_watching+0x15/0xb0 [ 1883.029333][T25743] ? do_syscall_64+0xbe/0x3b0 [ 1883.029348][T25743] do_syscall_64+0xfa/0x3b0 [ 1883.029361][T25743] ? lockdep_hardirqs_on+0x9c/0x150 [ 1883.029374][T25743] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1883.029385][T25743] ? clear_bhb_loop+0x60/0xb0 [ 1883.029396][T25743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1883.029406][T25743] RIP: 0033:0x7ff39c98e929 [ 1883.029416][T25743] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1883.029425][T25743] RSP: 002b:00007ff39d710038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1883.029437][T25743] RAX: ffffffffffffffda RBX: 00007ff39cbb5fa0 RCX: 00007ff39c98e929 [ 1883.029444][T25743] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 1883.029451][T25743] RBP: 00007ff39d710090 R08: 0000000000000000 R09: 0000000000000000 [ 1883.029457][T25743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1883.029463][T25743] R13: 0000000000000000 R14: 00007ff39cbb5fa0 R15: 00007ff39ccdfa28 [ 1883.029478][T25743] [ 1883.029510][T25743] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4372'. [ 1883.734255][T25753] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4376'. [ 1883.882066][ T5907] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 1883.889989][T19607] usb 6-1: f81604_read: reg: 105 failed: -EPROTO [ 1883.928770][T19607] f81604 6-1:0.0: Setting termination of CH#0 failed: -EPROTO [ 1883.991583][T19607] f81604 6-1:0.0: probe with driver f81604 failed with error -71 [ 1884.047838][T19607] usb 6-1: USB disconnect, device number 36 [ 1884.052627][ T5934] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1884.062182][ T5907] usb 1-1: Using ep0 maxpacket: 8 [ 1884.079639][ T5907] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 1884.120185][ T5907] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.00 [ 1884.131158][ T5907] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1884.146930][ T5934] usb 3-1: device descriptor read/8, error -71 [ 1884.156015][ T5907] usb 1-1: config 0 descriptor?? [ 1884.202073][T22988] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 1884.352072][T22988] usb 4-1: Using ep0 maxpacket: 8 [ 1884.360570][T22988] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 1884.396361][T22988] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.00 [ 1884.422191][ T5934] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 1884.458717][T22988] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1884.478698][ T5934] usb 3-1: device descriptor read/8, error -71 [ 1884.562766][T22988] usb 4-1: config 0 descriptor?? [ 1884.592799][ T5934] usb usb3-port1: unable to enumerate USB device [ 1884.650012][ T5907] corsair 0003:1B1C:1B09.0021: unbalanced delimiter at end of report description [ 1884.703160][ T5907] corsair 0003:1B1C:1B09.0021: parse failed [ 1884.710908][ T5907] corsair 0003:1B1C:1B09.0021: probe with driver corsair failed with error -22 [ 1884.894131][ T5934] usb 1-1: USB disconnect, device number 99 [ 1884.982766][T22988] corsair 0003:1B1C:1B09.0022: unbalanced delimiter at end of report description [ 1884.999340][T22988] corsair 0003:1B1C:1B09.0022: parse failed [ 1885.025814][T22988] corsair 0003:1B1C:1B09.0022: probe with driver corsair failed with error -22 [ 1885.152299][ T5907] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 1885.240137][T22988] usb 4-1: USB disconnect, device number 88 [ 1885.314135][ T5907] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 127, changing to 10 [ 1885.331872][ T5907] usb 3-1: New USB device found, idVendor=0c70, idProduct=f0bd, bcdDevice= 0.00 [ 1885.358595][ T5907] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1885.387392][ T5907] usb 3-1: config 0 descriptor?? [ 1885.997514][T25778] binder: 25775:25778 ioctl c0306201 200000001a80 returned -22 [ 1886.010146][ T5907] aquacomputer_d5next 0003:0C70:F0BD.0023: hidraw0: USB HID v0.00 Device [HID 0c70:f0bd] on usb-dummy_hcd.2-1/input0 [ 1886.195028][ T5934] usb 3-1: USB disconnect, device number 100 [ 1886.359340][T25781] fido_id[25781]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 1887.206707][T25803] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4389'. [ 1887.237232][T25803] fuse: Bad value for 'fd' [ 1888.416669][T25810] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4393'. [ 1888.875603][T25812] netlink: 'syz.0.4394': attribute type 3 has an invalid length. [ 1888.974254][T25815] netlink: 'syz.5.4396': attribute type 3 has an invalid length. [ 1890.892160][ T5900] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1891.064035][ T5900] usb 6-1: config 0 has no interfaces? [ 1891.074857][ T5900] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1891.092780][ T5900] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1891.101046][ T5900] usb 6-1: Product: syz [ 1891.108212][ T5900] usb 6-1: Manufacturer: syz [ 1891.115620][ T5900] usb 6-1: SerialNumber: syz [ 1891.128804][ T5900] usb 6-1: config 0 descriptor?? [ 1891.151811][T25850] bridge7: entered allmulticast mode [ 1891.298769][T25852] vlan2: entered promiscuous mode [ 1891.417148][T25852] vlan2: entered allmulticast mode [ 1891.430982][T25852] hsr_slave_1: entered allmulticast mode [ 1891.456240][T25836] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4400'. [ 1891.486221][T25852] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4406'. [ 1891.692513][T25859] netlink: 'syz.2.4408': attribute type 3 has an invalid length. [ 1891.851446][T25861] netlink: 'syz.1.4410': attribute type 3 has an invalid length. [ 1891.981904][T25866] FAULT_INJECTION: forcing a failure. [ 1891.981904][T25866] name failslab, interval 1, probability 0, space 0, times 0 [ 1891.994992][T25866] CPU: 0 UID: 0 PID: 25866 Comm: syz.0.4409 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1891.995008][T25866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1891.995015][T25866] Call Trace: [ 1891.995021][T25866] [ 1891.995026][T25866] dump_stack_lvl+0x189/0x250 [ 1891.995046][T25866] ? __pfx____ratelimit+0x10/0x10 [ 1891.995061][T25866] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1891.995075][T25866] ? __pfx__printk+0x10/0x10 [ 1891.995087][T25866] ? __lock_acquire+0xab9/0xd20 [ 1891.995105][T25866] should_fail_ex+0x414/0x560 [ 1891.995120][T25866] should_failslab+0xa8/0x100 [ 1891.995132][T25866] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1891.995147][T25866] ? sctp_get_port_local+0x6bb/0x1610 [ 1891.995262][T25866] sctp_get_port_local+0x6bb/0x1610 [ 1891.995281][T25866] ? __pfx_sctp_get_port_local+0x10/0x10 [ 1891.995294][T25866] ? sctp_bind_addr_match+0x30/0x2b0 [ 1891.995303][T25866] ? sctp_bind_addr_match+0x28b/0x2b0 [ 1891.995315][T25866] sctp_do_bind+0x4ea/0x940 [ 1891.995332][T25866] sctp_setsockopt_bindx+0x260/0x430 [ 1891.995347][T25866] sctp_setsockopt+0x7eb/0x1200 [ 1891.995358][T25866] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1891.995375][T25866] do_sock_setsockopt+0x257/0x3e0 [ 1891.995387][T25866] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 1891.995401][T25866] ? __fget_files+0x2a/0x420 [ 1891.995416][T25866] __x64_sys_setsockopt+0x18b/0x220 [ 1891.995430][T25866] do_syscall_64+0xfa/0x3b0 [ 1891.995443][T25866] ? lockdep_hardirqs_on+0x9c/0x150 [ 1891.995457][T25866] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1891.995466][T25866] ? clear_bhb_loop+0x60/0xb0 [ 1891.995478][T25866] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1891.995488][T25866] RIP: 0033:0x7f9aba98e929 [ 1891.995499][T25866] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1891.995507][T25866] RSP: 002b:00007f9abb736038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1891.995519][T25866] RAX: ffffffffffffffda RBX: 00007f9ababb5fa0 RCX: 00007f9aba98e929 [ 1891.995526][T25866] RDX: 0000000000000064 RSI: 0000000000000084 RDI: 0000000000000003 [ 1891.995533][T25866] RBP: 00007f9abb736090 R08: 0000000000000010 R09: 0000000000000000 [ 1891.995539][T25866] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000001 [ 1891.995545][T25866] R13: 0000000000000000 R14: 00007f9ababb5fa0 R15: 00007f9abacdfa28 [ 1891.995560][T25866] [ 1893.302133][ T5934] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 1893.464504][ T5934] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1893.558379][ T5934] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1893.567098][T14007] usb 6-1: USB disconnect, device number 37 [ 1893.616694][ T5934] usb 3-1: config 0 descriptor?? [ 1894.052163][T14007] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 1894.212163][T14007] usb 6-1: Using ep0 maxpacket: 8 [ 1894.342900][T14007] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 1894.436585][T14007] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.00 [ 1894.446292][T14007] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1894.654145][T14007] usb 6-1: config 0 descriptor?? [ 1894.725459][ T5934] ath6kl: Failed to submit usb control message: -110 [ 1894.758700][ T5934] ath6kl: unable to send the bmi data to the device: -110 [ 1894.813855][ T5934] ath6kl: Unable to send get target info: -110 [ 1894.903669][ T5934] ath6kl: Failed to init ath6kl core: -110 [ 1894.911231][ T5934] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1895.197665][T14007] corsair 0003:1B1C:1B09.0024: unbalanced delimiter at end of report description [ 1895.213590][T14007] corsair 0003:1B1C:1B09.0024: parse failed [ 1895.219728][T14007] corsair 0003:1B1C:1B09.0024: probe with driver corsair failed with error -22 [ 1895.624888][T14007] usb 6-1: USB disconnect, device number 38 [ 1896.267070][T14007] usb 3-1: USB disconnect, device number 101 [ 1896.346866][T25907] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4421'. [ 1896.363347][T25909] netlink: 'syz.2.4422': attribute type 3 has an invalid length. [ 1898.682800][ T5934] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 1899.043033][ T5934] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1899.105169][ T5934] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1899.162601][ T5934] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1899.245277][ T5934] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1899.353131][T25921] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1899.415303][ T5934] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1899.437113][ T5934] usb 4-1: config 0 descriptor?? [ 1899.482051][ T5835] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 1899.642316][ T5900] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 1899.715961][ T5835] usb 6-1: config 0 has no interfaces? [ 1899.728735][ T5835] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1899.747204][ T5835] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1899.755905][ T5835] usb 6-1: Product: syz [ 1899.868930][ T5900] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 1899.881533][T25929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1899.890276][ T5900] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1899.913348][ T5835] usb 6-1: Manufacturer: syz [ 1899.915093][T25929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1899.917997][ T5835] usb 6-1: SerialNumber: syz [ 1899.927038][ T5900] usb 3-1: config 0 has no interface number 0 [ 1899.953485][ T5900] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1899.987713][ T5900] usb 3-1: config 0 interface 117 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1900.001606][ T5934] usbhid 4-1:0.0: can't add hid device: -71 [ 1900.016326][ T5835] usb 6-1: config 0 descriptor?? [ 1900.032362][ T5934] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1900.034384][ T5900] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 1900.072493][ T5900] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1900.101584][ T5900] usb 3-1: Product: syz [ 1900.106026][ T5934] usb 4-1: USB disconnect, device number 89 [ 1900.151732][ T5900] usb 3-1: Manufacturer: syz [ 1900.165905][ T5900] usb 3-1: SerialNumber: syz [ 1900.212509][ T5900] usb 3-1: config 0 descriptor?? [ 1900.365923][T25934] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4427'. [ 1901.602071][ T5835] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 1901.716272][T25963] vlan2: entered promiscuous mode [ 1901.721510][T25963] vlan2: entered allmulticast mode [ 1901.738231][T25963] hsr_slave_1: entered allmulticast mode [ 1901.757584][ T5835] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1901.777863][ T5835] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1901.783462][ T5907] usb 6-1: USB disconnect, device number 39 [ 1901.793983][ T5835] usb 1-1: config 0 descriptor?? [ 1901.873487][T25963] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4437'. [ 1901.966236][T25969] FAULT_INJECTION: forcing a failure. [ 1901.966236][T25969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1901.982100][T25969] CPU: 0 UID: 0 PID: 25969 Comm: syz.5.4440 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1901.982125][T25969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1901.982136][T25969] Call Trace: [ 1901.982144][T25969] [ 1901.982152][T25969] dump_stack_lvl+0x189/0x250 [ 1901.982182][T25969] ? __pfx____ratelimit+0x10/0x10 [ 1901.982206][T25969] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1901.982231][T25969] ? __pfx__printk+0x10/0x10 [ 1901.982250][T25969] ? __might_fault+0xb0/0x130 [ 1901.982279][T25969] should_fail_ex+0x414/0x560 [ 1901.982305][T25969] _copy_from_user+0x2d/0xb0 [ 1901.982324][T25969] get_nodes+0x17f/0x390 [ 1901.982347][T25969] ? __pfx_get_nodes+0x10/0x10 [ 1901.982370][T25969] ? ksys_write+0x1cb/0x250 [ 1901.982390][T25969] __se_sys_mbind+0x18d/0xc30 [ 1901.982422][T25969] ? __pfx_vfs_write+0x10/0x10 [ 1901.982450][T25969] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1901.982478][T25969] ? __pfx___se_sys_mbind+0x10/0x10 [ 1901.982502][T25969] ? __fget_files+0x3a0/0x420 [ 1901.982528][T25969] ? fput+0xa0/0xd0 [ 1901.982549][T25969] ? ksys_write+0x22a/0x250 [ 1901.982576][T25969] ? __x64_sys_mbind+0x21/0xf0 [ 1901.982604][T25969] do_syscall_64+0xfa/0x3b0 [ 1901.982628][T25969] ? lockdep_hardirqs_on+0x9c/0x150 [ 1901.982651][T25969] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1901.982668][T25969] ? clear_bhb_loop+0x60/0xb0 [ 1901.982690][T25969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1901.982707][T25969] RIP: 0033:0x7faaf518e929 [ 1901.982724][T25969] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1901.982738][T25969] RSP: 002b:00007faaf60af038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed [ 1901.982758][T25969] RAX: ffffffffffffffda RBX: 00007faaf53b5fa0 RCX: 00007faaf518e929 [ 1901.982771][T25969] RDX: 0000000000004000 RSI: 0000000000004000 RDI: 0000200000ffb000 [ 1901.982783][T25969] RBP: 00007faaf60af090 R08: 0000000000002d02 R09: 0000000000000004 [ 1901.982794][T25969] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000002 [ 1901.982805][T25969] R13: 0000000000000001 R14: 00007faaf53b5fa0 R15: 00007faaf54dfa28 [ 1901.982833][T25969] [ 1902.424938][ T5907] usb 3-1: USB disconnect, device number 102 [ 1902.488165][T25979] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4441'. [ 1902.903314][ T5835] ath6kl: Failed to submit usb control message: -110 [ 1902.950662][ T5835] ath6kl: unable to send the bmi data to the device: -110 [ 1902.983803][ T5835] ath6kl: Unable to send get target info: -110 [ 1903.093439][ T5835] ath6kl: Failed to init ath6kl core: -110 [ 1903.148456][ T5835] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1903.312156][T14007] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 1903.492241][T14007] usb 6-1: Using ep0 maxpacket: 16 [ 1903.863568][T14007] usb 6-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 1903.872937][T14007] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1903.892059][T14007] usb 6-1: Product: syz [ 1903.896244][T14007] usb 6-1: Manufacturer: syz [ 1903.900857][T14007] usb 6-1: SerialNumber: syz [ 1903.983038][T14007] usb 6-1: config 0 descriptor?? [ 1904.082082][ T5934] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 1904.128754][T25997] syzkaller1: tun_chr_ioctl cmd 35108 [ 1904.377459][T14007] speedtch 6-1:0.0: speedtch_bind: wrong device class 68 [ 1904.387389][ T5934] usb 3-1: config 0 has no interfaces? [ 1904.393196][T14007] speedtch 6-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1904.409678][ T5934] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1904.422069][ T5934] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1904.437828][T25989] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1904.446330][ T5934] usb 3-1: Product: syz [ 1904.450527][ T5934] usb 3-1: Manufacturer: syz [ 1904.455260][ T5934] usb 3-1: SerialNumber: syz [ 1904.460188][T25989] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1904.469768][ T5934] usb 3-1: config 0 descriptor?? [ 1904.475805][T14007] usb 6-1: USB disconnect, device number 40 [ 1904.548361][T26004] netlink: 'syz.1.4452': attribute type 3 has an invalid length. [ 1904.722370][ T5907] usb 1-1: USB disconnect, device number 100 [ 1904.741745][T25994] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4448'. [ 1904.770224][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 1904.770240][ T30] audit: type=1326 audit(1751197960.545:8447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1904.871361][ T30] audit: type=1326 audit(1751197960.545:8448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1904.952414][ T30] audit: type=1326 audit(1751197960.545:8449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=48 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1905.086101][ T30] audit: type=1326 audit(1751197960.545:8450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1905.142323][ T5907] usb 1-1: new high-speed USB device number 101 using dummy_hcd [ 1905.154230][ T30] audit: type=1326 audit(1751197960.545:8451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=286 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1905.182511][T14007] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 1905.269861][ T30] audit: type=1326 audit(1751197960.545:8452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1905.318320][ T30] audit: type=1326 audit(1751197960.545:8453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1905.372088][T14007] usb 4-1: Using ep0 maxpacket: 16 [ 1905.378268][T14007] usb 4-1: too many configurations: 123, using maximum allowed: 8 [ 1905.390490][T14007] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.418464][T14007] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.431235][ T5907] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1023 [ 1905.462600][ T5907] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 1905.467966][T14007] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.498790][T14007] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.525633][T14007] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.545750][T14007] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.560802][ T5907] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1905.561079][T14007] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.582255][ T5907] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1905.590316][ T30] audit: type=1326 audit(1751197960.545:8454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1905.590330][ T5915] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 1905.612840][ T5907] usb 1-1: Product: ŕ䂭뼦虨뒴⏽餀숌ﱝ稷傴头ꥮ凼䊒뽈Ꝑ兲삢䅯໑n彸捕熴𢡊엾豨⺮⾿丗ধ쐜ᚰ嚭ꁀ쫰―ꪻ샒䕐愐欁镲鸀벽⢳䍸ﰒꫲ堼뽽橽ꀜ醮갭瀖緀蘞㸁ֶ᭢ᔟફ桐瞖䜡꜐徧䮔躎밻剾 怦㕗먴쇰⹀ꩧ繝⩹掮ȱ鲉 [ 1905.612874][ T5907] usb 1-1: Manufacturer: 㐁 [ 1905.612888][ T5907] usb 1-1: SerialNumber: 遍思᪾쮝柵怶፜툚뷭⮴ୖ䕠巈唣ꮴ췦竐蒵瘿蕯㵪 [ 1905.614546][ T30] audit: type=1326 audit(1751197960.545:8455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1905.709360][ T30] audit: type=1326 audit(1751197960.545:8456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26009 comm="syz.3.4454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3b6658e929 code=0x7ffc0000 [ 1905.749619][T14007] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.761294][T14007] usb 4-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 1905.771365][T14007] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 1905.792536][T14007] usb 4-1: SerialNumber: syz [ 1905.816179][T14007] usb 4-1: config 0 descriptor?? [ 1905.838785][T14007] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input117 [ 1905.894343][ T5915] usb 6-1: config 0 has no interfaces? [ 1905.903423][ T5907] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 1905.910738][ T5907] cdc_ncm 1-1:1.0: bind() failure [ 1905.919967][ T5915] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1905.924369][ T5907] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 1905.937011][ T5915] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1905.945496][ T5915] usb 6-1: Product: syz [ 1905.949691][ T5915] usb 6-1: Manufacturer: syz [ 1905.968237][ T5907] cdc_ncm 1-1:1.1: bind() failure [ 1905.986341][ T5915] usb 6-1: SerialNumber: syz [ 1906.037160][T26018] netlink: 'syz.3.4456': attribute type 6 has an invalid length. [ 1906.128706][ T5934] usb 1-1: USB disconnect, device number 101 [ 1906.137554][ T5915] usb 6-1: config 0 descriptor?? [ 1906.175250][T26018] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1906.214287][T26018] openvswitch: netlink: IPv4 tun info is not correct [ 1906.270621][T26018] input: syz1 as /devices/virtual/input/input118 [ 1906.292744][ T5188] bcm5974 4-1:0.0: could not read from device [ 1906.305296][ T5188] bcm5974 4-1:0.0: could not read from device [ 1906.331506][ T5188] bcm5974 4-1:0.0: could not read from device [ 1906.402791][T14007] usb 4-1: USB disconnect, device number 90 [ 1906.420048][ T5188] bcm5974 4-1:0.0: could not read from device [ 1906.466209][ T5900] usb 3-1: USB disconnect, device number 103 [ 1906.568532][T26028] bridge8: entered promiscuous mode [ 1907.668978][T26047] netlink: 'syz.3.4466': attribute type 3 has an invalid length. [ 1907.782270][ T5934] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 1908.270469][T19607] usb 6-1: USB disconnect, device number 41 [ 1908.413900][ T5934] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1908.448853][ T5934] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1908.484339][ T5934] usb 3-1: config 0 descriptor?? [ 1909.681859][T26058] netlink: 'syz.3.4469': attribute type 3 has an invalid length. [ 1909.690329][ T5934] ath6kl: Failed to submit usb control message: -110 [ 1909.707999][ T5934] ath6kl: unable to send the bmi data to the device: -110 [ 1909.728548][ T5934] ath6kl: Unable to send get target info: -110 [ 1909.812460][ T5934] ath6kl: Failed to init ath6kl core: -110 [ 1909.831321][ T5934] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1909.992056][T14007] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 1910.386057][T14007] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1910.427141][T14007] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1910.443623][T14007] usb 6-1: config 0 descriptor?? [ 1910.602715][ T5915] usb 3-1: USB disconnect, device number 104 [ 1911.609955][T14007] ath6kl: Failed to submit usb control message: -110 [ 1911.662799][T14007] ath6kl: unable to send the bmi data to the device: -110 [ 1911.669994][T14007] ath6kl: Unable to send get target info: -110 [ 1911.701149][T14007] ath6kl: Failed to init ath6kl core: -110 [ 1911.854365][T14007] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1912.596635][T26077] FAULT_INJECTION: forcing a failure. [ 1912.596635][T26077] name failslab, interval 1, probability 0, space 0, times 0 [ 1912.741346][T26077] CPU: 1 UID: 0 PID: 26077 Comm: syz.1.4473 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1912.741374][T26077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1912.741386][T26077] Call Trace: [ 1912.741394][T26077] [ 1912.741403][T26077] dump_stack_lvl+0x189/0x250 [ 1912.741435][T26077] ? __pfx____ratelimit+0x10/0x10 [ 1912.741461][T26077] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1912.741486][T26077] ? __pfx__printk+0x10/0x10 [ 1912.741519][T26077] ? __pfx___might_resched+0x10/0x10 [ 1912.741544][T26077] ? fs_reclaim_acquire+0x7d/0x100 [ 1912.741570][T26077] should_fail_ex+0x414/0x560 [ 1912.741598][T26077] should_failslab+0xa8/0x100 [ 1912.741620][T26077] __kmalloc_cache_noprof+0x70/0x3d0 [ 1912.741638][T26077] ? tomoyo_init_log+0x183/0x1f70 [ 1912.741746][T26077] tomoyo_init_log+0x183/0x1f70 [ 1912.741776][T26077] ? kasan_save_track+0x4f/0x80 [ 1912.741800][T26077] ? kasan_save_track+0x3e/0x80 [ 1912.741822][T26077] ? __kasan_slab_free+0x62/0x70 [ 1912.741841][T26077] ? format_decode+0xd9/0xe30 [ 1912.741862][T26077] ? string+0x279/0x2b0 [ 1912.741885][T26077] ? __pfx_tomoyo_init_log+0x10/0x10 [ 1912.741907][T26077] ? tomoyo_profile+0x11/0x50 [ 1912.741928][T26077] ? tomoyo_profile+0x11/0x50 [ 1912.741952][T26077] ? tomoyo_domain_quota_is_ok+0x42b/0x570 [ 1912.741976][T26077] tomoyo_supervisor+0x340/0x1480 [ 1912.742013][T26077] ? __pfx_tomoyo_supervisor+0x10/0x10 [ 1912.742037][T26077] ? kasan_quarantine_put+0xdd/0x220 [ 1912.742061][T26077] ? lockdep_hardirqs_on+0x9c/0x150 [ 1912.742091][T26077] ? tomoyo_realpath_from_path+0x598/0x5d0 [ 1912.742128][T26077] ? tomoyo_check_acl+0x386/0x400 [ 1912.742148][T26077] ? __pfx_tomoyo_check_path2_acl+0x10/0x10 [ 1912.742173][T26077] tomoyo_path2_perm+0x4e3/0x680 [ 1912.742194][T26077] ? tomoyo_path2_perm+0x235/0x680 [ 1912.742216][T26077] ? __pfx_tomoyo_path2_perm+0x10/0x10 [ 1912.742250][T26077] ? register_lock_class+0x51/0x320 [ 1912.742309][T26077] tomoyo_path_rename+0x141/0x190 [ 1912.742337][T26077] ? __pfx_tomoyo_path_rename+0x10/0x10 [ 1912.742376][T26077] security_path_rename+0x250/0x490 [ 1912.742405][T26077] do_renameat2+0x64d/0xc50 [ 1912.742445][T26077] ? __pfx_do_renameat2+0x10/0x10 [ 1912.742480][T26077] ? getname_flags+0x1e5/0x540 [ 1912.742511][T26077] __x64_sys_renameat2+0xce/0xe0 [ 1912.742534][T26077] do_syscall_64+0xfa/0x3b0 [ 1912.742558][T26077] ? lockdep_hardirqs_on+0x9c/0x150 [ 1912.742581][T26077] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1912.742599][T26077] ? clear_bhb_loop+0x60/0xb0 [ 1912.742622][T26077] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1912.742640][T26077] RIP: 0033:0x7ff39c98e929 [ 1912.742658][T26077] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1912.742674][T26077] RSP: 002b:00007ff39d710038 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 1912.742695][T26077] RAX: ffffffffffffffda RBX: 00007ff39cbb5fa0 RCX: 00007ff39c98e929 [ 1912.742709][T26077] RDX: ffffffffffffff9c RSI: 00002000000008c0 RDI: ffffffffffffff9c [ 1912.742723][T26077] RBP: 00007ff39d710090 R08: 0000000000000000 R09: 0000000000000000 [ 1912.742736][T26077] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000002 [ 1912.742748][T26077] R13: 0000000000000000 R14: 00007ff39cbb5fa0 R15: 00007ff39ccdfa28 [ 1912.742779][T26077] [ 1913.360072][T26090] FAULT_INJECTION: forcing a failure. [ 1913.360072][T26090] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1913.374464][T26090] CPU: 1 UID: 0 PID: 26090 Comm: syz.3.4479 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1913.374490][T26090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1913.374501][T26090] Call Trace: [ 1913.374510][T26090] [ 1913.374519][T26090] dump_stack_lvl+0x189/0x250 [ 1913.374560][T26090] ? __pfx____ratelimit+0x10/0x10 [ 1913.374586][T26090] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1913.374611][T26090] ? __pfx__printk+0x10/0x10 [ 1913.374631][T26090] ? __might_fault+0xb0/0x130 [ 1913.374660][T26090] should_fail_ex+0x414/0x560 [ 1913.374687][T26090] _copy_from_user+0x2d/0xb0 [ 1913.374706][T26090] __sys_bpf+0x1ed/0x860 [ 1913.374732][T26090] ? __pfx___sys_bpf+0x10/0x10 [ 1913.374766][T26090] ? ksys_write+0x22a/0x250 [ 1913.374785][T26090] ? __pfx_ksys_write+0x10/0x10 [ 1913.374799][T26090] ? rcu_is_watching+0x15/0xb0 [ 1913.374831][T26090] __x64_sys_bpf+0x7c/0x90 [ 1913.374853][T26090] do_syscall_64+0xfa/0x3b0 [ 1913.374875][T26090] ? lockdep_hardirqs_on+0x9c/0x150 [ 1913.374894][T26090] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1913.374908][T26090] ? clear_bhb_loop+0x60/0xb0 [ 1913.374926][T26090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1913.374939][T26090] RIP: 0033:0x7f3b6658e929 [ 1913.374953][T26090] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1913.374966][T26090] RSP: 002b:00007f3b674a0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1913.374982][T26090] RAX: ffffffffffffffda RBX: 00007f3b667b5fa0 RCX: 00007f3b6658e929 [ 1913.374993][T26090] RDX: 0000000000000094 RSI: 0000200000000200 RDI: 0000000000000005 [ 1913.375003][T26090] RBP: 00007f3b674a0090 R08: 0000000000000000 R09: 0000000000000000 [ 1913.375013][T26090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1913.375021][T26090] R13: 0000000000000000 R14: 00007f3b667b5fa0 R15: 00007f3b668dfa28 [ 1913.375044][T26090] [ 1913.391828][T26086] vlan2: entered promiscuous mode [ 1913.518023][ T5934] usb 6-1: USB disconnect, device number 42 [ 1913.572645][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 1913.572662][ T30] audit: type=1326 audit(1751197969.345:8487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26087 comm="syz.1.4478" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff39c98e929 code=0x0 [ 1913.622846][T26086] vlan2: entered allmulticast mode [ 1913.630085][T26091] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4477'. [ 1913.661343][T26086] hsr_slave_1: entered allmulticast mode [ 1913.675929][T26096] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1913.716158][T26096] netlink: 'syz.3.4480': attribute type 11 has an invalid length. [ 1913.930261][T26105] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 1913.936789][T26105] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1913.951377][T26105] vhci_hcd vhci_hcd.0: Device attached [ 1913.972312][ T5934] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 1914.136362][ T5934] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1914.146136][ T5934] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1914.181453][ T5934] usb 6-1: config 0 descriptor?? [ 1914.192668][ T5900] usb 1-1: new high-speed USB device number 102 using dummy_hcd [ 1914.200808][T19607] usb 33-1: new low-speed USB device number 2 using vhci_hcd [ 1914.382630][ T5900] usb 1-1: config 0 has no interfaces? [ 1914.391832][ T5900] usb 1-1: New USB device found, idVendor=0de5, idProduct=0056, bcdDevice= 5.b5 [ 1914.486587][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1914.493072][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1914.535783][ T5900] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1914.557325][ T5900] usb 1-1: config 0 descriptor?? [ 1914.854175][ T5900] usb 1-1: USB disconnect, device number 102 [ 1914.857219][T26106] vhci_hcd: connection closed [ 1914.889207][ T59] vhci_hcd: stop threads [ 1914.929050][ T59] vhci_hcd: release socket [ 1915.061819][T19607] usb 33-1: device descriptor read/64, error -71 [ 1915.077424][ T59] vhci_hcd: disconnect device [ 1915.207452][T26129] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4491'. [ 1915.268096][T19607] vhci_hcd: vhci_device speed not set [ 1915.377599][ T5934] ath6kl: Failed to submit usb control message: -110 [ 1915.384385][ T5934] ath6kl: unable to send the bmi data to the device: -110 [ 1915.391510][ T5934] ath6kl: Unable to send get target info: -110 [ 1915.412398][ T5934] ath6kl: Failed to init ath6kl core: -110 [ 1915.458411][ T5934] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1916.242619][ T5900] usb 1-1: new high-speed USB device number 103 using dummy_hcd [ 1916.413511][ T5900] usb 1-1: device descriptor read/64, error -71 [ 1916.693274][ T5900] usb 1-1: new high-speed USB device number 104 using dummy_hcd [ 1916.852954][ T5900] usb 1-1: device descriptor read/64, error -71 [ 1916.999428][ T5900] usb usb1-port1: attempt power cycle [ 1917.042290][T19607] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 1917.193856][ T5934] usb 6-1: USB disconnect, device number 43 [ 1917.215320][T19607] usb 4-1: Using ep0 maxpacket: 16 [ 1917.225315][T19607] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 1917.253070][T19607] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1917.279160][T19607] usb 4-1: config 0 descriptor?? [ 1917.289178][T26145] netlink: 'syz.5.4498': attribute type 3 has an invalid length. [ 1917.311531][T19607] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 1917.362202][ T5900] usb 1-1: new high-speed USB device number 105 using dummy_hcd [ 1917.424266][ T5900] usb 1-1: device descriptor read/8, error -71 [ 1917.525413][T19607] usb 4-1: Detected FT232B [ 1917.692140][ T5900] usb 1-1: new high-speed USB device number 106 using dummy_hcd [ 1917.735731][T19607] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 1917.744170][ T5900] usb 1-1: device descriptor read/8, error -71 [ 1917.755319][T19607] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 1917.767571][T26159] netlink: 'syz.2.4502': attribute type 21 has an invalid length. [ 1917.788756][T19607] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1917.793349][T26159] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4502'. [ 1917.825107][T19607] usb 4-1: USB disconnect, device number 91 [ 1917.859950][T26159] netlink: 'syz.2.4502': attribute type 4 has an invalid length. [ 1917.861250][T19607] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1917.878384][ T5900] usb usb1-port1: unable to enumerate USB device [ 1917.884519][T26159] netlink: 'syz.2.4502': attribute type 5 has an invalid length. [ 1917.920480][T19607] ftdi_sio 4-1:0.0: device disconnected [ 1917.924604][T26159] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4502'. [ 1918.272248][T26163] vlan4: entered promiscuous mode [ 1918.277497][T26163] vlan4: entered allmulticast mode [ 1918.294912][T26163] hsr_slave_1: entered allmulticast mode [ 1918.348711][T26163] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4503'. [ 1918.379090][T26166] FAULT_INJECTION: forcing a failure. [ 1918.379090][T26166] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1918.437708][T26166] CPU: 1 UID: 0 PID: 26166 Comm: syz.3.4504 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1918.437736][T26166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1918.437748][T26166] Call Trace: [ 1918.437755][T26166] [ 1918.437764][T26166] dump_stack_lvl+0x189/0x250 [ 1918.437795][T26166] ? __pfx____ratelimit+0x10/0x10 [ 1918.437819][T26166] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1918.437844][T26166] ? __pfx__printk+0x10/0x10 [ 1918.437863][T26166] ? __might_fault+0xb0/0x130 [ 1918.437892][T26166] should_fail_ex+0x414/0x560 [ 1918.437919][T26166] _copy_from_user+0x2d/0xb0 [ 1918.437937][T26166] video_usercopy+0x354/0x14f0 [ 1918.438065][T26166] ? __pfx___video_do_ioctl+0x10/0x10 [ 1918.438083][T26166] ? __pfx_video_usercopy+0x10/0x10 [ 1918.438112][T26166] ? __fget_files+0x2a/0x420 [ 1918.438134][T26166] ? __fget_files+0x2a/0x420 [ 1918.438152][T26166] ? __fget_files+0x3a0/0x420 [ 1918.438180][T26166] v4l2_ioctl+0x18d/0x1e0 [ 1918.438199][T26166] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1918.438249][T26166] __se_sys_ioctl+0xfc/0x170 [ 1918.438276][T26166] do_syscall_64+0xfa/0x3b0 [ 1918.438300][T26166] ? lockdep_hardirqs_on+0x9c/0x150 [ 1918.438323][T26166] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1918.438341][T26166] ? clear_bhb_loop+0x60/0xb0 [ 1918.438363][T26166] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1918.438381][T26166] RIP: 0033:0x7f3b6658e929 [ 1918.438398][T26166] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1918.438413][T26166] RSP: 002b:00007f3b674a0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1918.438433][T26166] RAX: ffffffffffffffda RBX: 00007f3b667b5fa0 RCX: 00007f3b6658e929 [ 1918.438447][T26166] RDX: 00002000000000c0 RSI: 00000000c0405668 RDI: 0000000000000003 [ 1918.438459][T26166] RBP: 00007f3b674a0090 R08: 0000000000000000 R09: 0000000000000000 [ 1918.438471][T26166] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1918.438482][T26166] R13: 0000000000000000 R14: 00007f3b667b5fa0 R15: 00007f3b668dfa28 [ 1918.438510][T26166] [ 1919.270913][T26189] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4509'. [ 1919.348469][T26189] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1919.646180][ T5907] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 1919.662457][ T5934] usb 3-1: new full-speed USB device number 105 using dummy_hcd [ 1919.798425][T26224] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4514'. [ 1919.838000][ T5907] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1919.847345][ T5907] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1919.863531][ T5907] usb 4-1: Product: syz [ 1919.874344][ T5907] usb 4-1: Manufacturer: syz [ 1919.886124][ T5934] usb 3-1: config 8 has an invalid interface number: 223 but max is 0 [ 1919.892586][ T5907] usb 4-1: SerialNumber: syz [ 1919.896442][ T5934] usb 3-1: config 8 has no interface number 0 [ 1919.907020][ T5934] usb 3-1: config 8 interface 223 altsetting 0 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 1919.918792][ T5934] usb 3-1: config 8 interface 223 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 1919.919901][ T5907] usb 4-1: config 0 descriptor?? [ 1919.946829][ T5934] usb 3-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 1919.957422][ T5934] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1919.968722][ T5934] usb 3-1: Product: syz [ 1919.976478][ T5934] usb 3-1: Manufacturer: syz [ 1919.981545][ T5934] usb 3-1: SerialNumber: syz [ 1920.175571][T26205] input: syz0 as /devices/virtual/input/input119 [ 1920.198707][ T5907] hso 4-1:0.0: Can't find BULK IN endpoint [ 1920.217587][ T5934] usb 3-1: USB disconnect, device number 105 [ 1920.315888][ T5907] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1920.432748][T14007] usb 4-1: USB disconnect, device number 92 [ 1920.948300][T26248] bridge9: entered promiscuous mode [ 1921.349019][T26255] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1921.360798][T26255] [ 1921.363154][T26255] ============================================ [ 1921.369291][T26255] WARNING: possible recursive locking detected [ 1921.375439][T26255] 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 Not tainted [ 1921.382535][T26255] -------------------------------------------- [ 1921.388669][T26255] syz.2.4516/26255 is trying to acquire lock: [ 1921.394718][T26255] ffff88807d424d30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: __netdev_update_features+0xcb1/0x1a20 [ 1921.405766][T26255] [ 1921.405766][T26255] but task is already holding lock: [ 1921.413117][T26255] ffff88807d424d30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_ethtool+0x716/0x1990 [ 1921.423012][T26255] and the lock comparison function returns 0: [ 1921.429059][T26255] [ 1921.429059][T26255] other info that might help us debug this: [ 1921.437107][T26255] Possible unsafe locking scenario: [ 1921.437107][T26255] [ 1921.444542][T26255] CPU0 [ 1921.447806][T26255] ---- [ 1921.451073][T26255] lock(&dev_instance_lock_key#20); [ 1921.456358][T26255] lock(&dev_instance_lock_key#20); [ 1921.461640][T26255] [ 1921.461640][T26255] *** DEADLOCK *** [ 1921.461640][T26255] [ 1921.469776][T26255] May be due to missing lock nesting notation [ 1921.469776][T26255] [ 1921.478083][T26255] 2 locks held by syz.2.4516/26255: [ 1921.483265][T26255] #0: ffffffff8f50f808 (rtnl_mutex){+.+.}-{4:4}, at: dev_ethtool+0x1d0/0x1990 [ 1921.492235][T26255] #1: ffff88807d424d30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: dev_ethtool+0x716/0x1990 [ 1921.502510][T26255] [ 1921.502510][T26255] stack backtrace: [ 1921.508393][T26255] CPU: 0 UID: 0 PID: 26255 Comm: syz.2.4516 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 1921.508413][T26255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1921.508423][T26255] Call Trace: [ 1921.508431][T26255] [ 1921.508439][T26255] dump_stack_lvl+0x189/0x250 [ 1921.508466][T26255] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1921.508488][T26255] ? __pfx__printk+0x10/0x10 [ 1921.508505][T26255] ? print_lock_name+0xde/0x100 [ 1921.508521][T26255] print_deadlock_bug+0x28b/0x2a0 [ 1921.508536][T26255] validate_chain+0x1a3f/0x2140 [ 1921.508557][T26255] __lock_acquire+0xab9/0xd20 [ 1921.508578][T26255] ? __netdev_update_features+0xcb1/0x1a20 [ 1921.508601][T26255] lock_acquire+0x120/0x360 [ 1921.508619][T26255] ? __netdev_update_features+0xcb1/0x1a20 [ 1921.508641][T26255] __mutex_lock+0x182/0xe80 [ 1921.508662][T26255] ? __netdev_update_features+0xcb1/0x1a20 [ 1921.508683][T26255] ? finish_task_switch+0x266/0x950 [ 1921.508700][T26255] ? __netdev_update_features+0xcb1/0x1a20 [ 1921.508717][T26255] ? lockdep_hardirqs_on+0x9c/0x150 [ 1921.508737][T26255] ? __pfx___mutex_lock+0x10/0x10 [ 1921.508757][T26255] ? bond_fix_features+0x191/0x1d0 [ 1921.508891][T26255] __netdev_update_features+0xcb1/0x1a20 [ 1921.508916][T26255] ? __pfx___netdev_update_features+0x10/0x10 [ 1921.508939][T26255] ? rcu_is_watching+0x15/0xb0 [ 1921.508960][T26255] ? trace_irq_disable+0x37/0x110 [ 1921.509012][T26255] ? preempt_schedule_irq+0xde/0x150 [ 1921.509031][T26255] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 1921.509049][T26255] ? __schedule+0x1713/0x4d00 [ 1921.509068][T26255] ? irqentry_exit+0x74/0x90 [ 1921.509088][T26255] ? lockdep_hardirqs_on+0x9c/0x150 [ 1921.509108][T26255] netdev_change_features+0x72/0xd0 [ 1921.509126][T26255] ? __pfx_netdev_change_features+0x10/0x10 [ 1921.509145][T26255] ? netif_set_tso_max_size+0x10e/0x1d0 [ 1921.509194][T26255] bond_compute_features+0x615/0x680 [ 1921.509215][T26255] ? __pfx_bond_compute_features+0x10/0x10 [ 1921.509236][T26255] bond_netdev_event+0x72e/0xe80 [ 1921.509253][T26255] ? __pfx_bond_netdev_event+0x10/0x10 [ 1921.509267][T26255] ? inetdev_event+0x464/0x15b0 [ 1921.509331][T26255] ? igmp_netdev_event+0x7c/0x770 [ 1921.509375][T26255] notifier_call_chain+0x1b3/0x3e0 [ 1921.509400][T26255] netdev_features_change+0x85/0xc0 [ 1921.509422][T26255] ? __pfx_netdev_features_change+0x10/0x10 [ 1921.509461][T26255] ? dev_ethtool+0xf3c/0x1990 [ 1921.509481][T26255] dev_ethtool+0x1520/0x1990 [ 1921.509499][T26255] ? rcu_is_watching+0x15/0xb0 [ 1921.509522][T26255] ? __pfx_dev_ethtool+0x10/0x10 [ 1921.509541][T26255] ? dev_load+0x21/0x1f0 [ 1921.509614][T26255] ? __rcu_read_unlock+0x84/0xe0 [ 1921.509632][T26255] ? dev_load+0x21/0x1f0 [ 1921.509652][T26255] dev_ioctl+0x392/0x1150 [ 1921.509666][T26255] sock_do_ioctl+0x22c/0x300 [ 1921.509687][T26255] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1921.509708][T26255] ? sock_ioctl+0x175/0x790 [ 1921.509725][T26255] ? __sanitizer_cov_trace_switch+0x82/0x130 [ 1921.509745][T26255] sock_ioctl+0x576/0x790 [ 1921.509763][T26255] ? __pfx_sock_ioctl+0x10/0x10 [ 1921.509780][T26255] ? __fget_files+0x2a/0x420 [ 1921.509796][T26255] ? __fget_files+0x3a0/0x420 [ 1921.509810][T26255] ? __fget_files+0x2a/0x420 [ 1921.509826][T26255] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1921.509846][T26255] ? __pfx_sock_ioctl+0x10/0x10 [ 1921.509864][T26255] __se_sys_ioctl+0xfc/0x170 [ 1921.509884][T26255] do_syscall_64+0xfa/0x3b0 [ 1921.509904][T26255] ? lockdep_hardirqs_on+0x9c/0x150 [ 1921.509922][T26255] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1921.509937][T26255] ? clear_bhb_loop+0x60/0xb0 [ 1921.509952][T26255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1921.509966][T26255] RIP: 0033:0x7fa1c8b8e929 [ 1921.509981][T26255] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1921.509994][T26255] RSP: 002b:00007fa1c616e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1921.510010][T26255] RAX: ffffffffffffffda RBX: 00007fa1c8db6320 RCX: 00007fa1c8b8e929 [ 1921.510021][T26255] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 000000000000000c [ 1921.510032][T26255] RBP: 00007fa1c8c10b39 R08: 0000000000000000 R09: 0000000000000000 [ 1921.510042][T26255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1921.510051][T26255] R13: 0000000000000000 R14: 00007fa1c8db6320 R15: 00007fa1c8edfa28 [ 1921.510067][T26255] [ 1922.073920][T14007] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 1922.566450][T14007] usb 4-1: New USB device found, idVendor=093a, idProduct=2476, bcdDevice= d.5b [ 1922.575729][T14007] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1922.584055][T14007] usb 4-1: Product: syz [ 1922.588326][T14007] usb 4-1: Manufacturer: syz [ 1922.594109][T14007] usb 4-1: SerialNumber: syz [ 1927.687975][T14007] gspca_main: pac207-2.14.0 probing 093a:2476 [ 1927.694462][T14007] gspca_pac207: Failed to read a register (index 0x0000, error -32)