last executing test programs: 11.194738038s ago: executing program 0 (id=1440): setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getdents64(0xffffffffffffffff, &(0x7f00000001c0)=""/23, 0x17) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$AUDIT_TTY_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x10, 0x3f8, 0x2, 0x4070bd28}, 0x384}, 0x1, 0x0, 0x0, 0x40}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x2, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f00000000c0)}], 0x1}, 0x4000000) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r3 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x22c01) ioctl$SCSI_IOCTL_SEND_COMMAND(r3, 0x1, &(0x7f00000000c0)=ANY=[]) r4 = syz_open_dev$vim2m(&(0x7f0000000040), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000080)={0x8, 0x1, 0x0, "9adf66552fb8af2b9f10f35681de96a590d25f2744e043cc1e70c317fd815cee", 0x3131354f}) syz_usb_connect$uac1(0x3, 0xc3, &(0x7f0000000300)={{0x12, 0x1, 0x3ada8a6e2fa02958, 0x0, 0x0, 0x0, 0xff, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb1, 0x3, 0x1, 0x1a, 0x20, 0x8, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x2, 0xd}, [@feature_unit={0xd, 0x24, 0x6, 0x6, 0x3, 0x3, [0x1, 0x3, 0x6], 0x7}, @extension_unit={0x9, 0x24, 0x8, 0x3, 0x9, 0x1, "f754"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0xe, 0xc1, 0x20, {0x7, 0x25, 0x1, 0x2, 0x0, 0xc}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0xc, 0x1, 0x5e}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x4, 0x3, 0x57, "b4"}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0xb77, 0xf, 0xa, "e61e0929eda52f9c"}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x8001, 0x4, 0x9, "b871a2b25e783a"}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0xc, 0x3, 0xa, 0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x7fb, 0x6, 0x3, 0x5, {0x7, 0x25, 0x1, 0x1, 0x6, 0x6}}}}}}}]}}, &(0x7f00000004c0)={0xa, &(0x7f0000000400)={0xa, 0x6, 0x200, 0x7f, 0x1, 0x2, 0x40, 0xff}, 0x2f, &(0x7f0000000440)={0x5, 0xf, 0x2f, 0x5, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x1, 0xc, 0x9}, @ssp_cap={0x10, 0x10, 0xa, 0xbc, 0x1, 0x8, 0x1e00, 0x5, [0xf]}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x4, 0x0, 0x9}, @ptm_cap={0x3}]}, 0x1, [{0x0, 0x0}]}) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$FBIOPUT_VSCREENINFO(r5, 0x4601, &(0x7f0000000040)={0x191, 0x140, 0xa0, 0x3f, 0x32, 0x1, 0x3f00, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0xfffffffd, 0x0, 0x8, 0x4, 0x0, 0x0, 0xa}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581", @ANYRES8], 0x0) 8.844067211s ago: executing program 4 (id=1451): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x40201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETTXFILTER(r0, 0x400454d1, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r4, &(0x7f0000000680)={'#! ', './file0', [], 0xa, "7355427547b5204f651aa607baa2fe1288779eedf1c978777198cb17a14dc9905951420ac1ec564f2e21e7b3500f7eeb3e4932f055a83fc6f26ccd2e80c7afe86f3a678c0fd04e4545b0f6162fefa2cb996d7e96a264d5fa8a742192d5d2360ade0103c248adff2e3c99f4b9ff580000837f4dab8ad6faa8b5d31f600b259ff1c09c961025e16692e780f3e8587a57d33fbf2382f012fae2e86b4b09ab458cd5b4e20e86534220930913232c1f5a480b99566f32a0430b8fa757e67b0a76ee4ecbb52dab583881962d9c343493c886268f8da3e1620301a96371a075a6798568c19f2d6454caffce9d73eb441340c98972c613a05218bde028190189c3fed1ebf8b5d12343ceba3e7e3a8eaf525462888f1fe11bbf7f3af1dd66c3afb422c7d88d21cf2a6574000000000000000000009e9a9b162a9d6097a714998da6d987401a1c97694431a5eb95da573ee878e9ecd514221128490715e4d0b9359960adc94e03a152d1e3084e"}, 0x173) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x182fd000) preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x2, 0x3}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@local, @random="bfee05ab5ac3", @void, {@ipv6={0x86dd, @dccp_packet={0x3, 0x6, "ec820e", 0x10, 0x21, 0x0, @local, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {[], {{0x4e20, 0x4e21, 0x4, 0x1, 0xf, 0x0, 0x0, 0x5, 0x7, "03ae81", 0x85, "b925fd"}}}}}}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@ipv6_newroute={0x24, 0x18, 0x601, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0xfc, 0x1}, [@RTA_METRICS={0x5, 0x8, 0x0, 0x1, "1d"}]}, 0x24}}, 0x0) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) 8.1114322s ago: executing program 4 (id=1452): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002140)=@delchain={0x174, 0x65, 0x20, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0xd}, {0x0, 0xffea}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_route={{0xa}, {0x48, 0x2, [@TCA_ROUTE4_ACT={0x44, 0x6, [@m_vlan={0x40, 0x6, 0x0, 0x0, {{0x9}, {0x14, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x1b6}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}}, @filter_kind_options=@f_bpf={{0x8}, {0xec, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0xd4, 0x1, [@m_nat={0xd0, 0xa, 0x0, 0x0, {{0x8}, {0x4}, {0xa6, 0x6, "455c01c35a2bca70225b757b65e5e4a3d41b6fb981e9f5ab2f14ad001cda09785441b436361246e3000e13fa20bea090aab2bdd9895404add20f4fcf1a162cef77fa510e284971b2c20e689c84c729801c399b2e8e9d7612504fa384dfa0fff7632779c87cbc4514e6104d9c559f50b25734ad06a5ddf0fb7c97e85209e4d13a9bbed8be1bc47fef2d1001f0ec1073cc1f8efb57e77a5e5f3f0cd2a93034ee179196"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}}]}, 0x174}, 0x1, 0x0, 0x0, 0x80}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0xffffffa1}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 7.844446237s ago: executing program 4 (id=1453): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, 0x0, 0x4008804) sendmsg$kcm(r0, &(0x7f0000000480)={&(0x7f00000002c0)=@l2tp={0x2, 0x0, @remote}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000c40)="3282db78e0ea55c52d87bc2a166b9e46818f5faca0b3a411e056b7928ccacd30019d925e47ecd2f92675d1d80000000000000004007d002ae359e2b5d768e71db355cf220bb96b7a64e1d2629c3e21c5decd0e2e6f107e35a8081587d3dc42a0bc0d0c5e85c355c9cbadd6e8f8014acb52d24b961a3989d5102d540829ad660fdca299e7e74a71ed264d75a3e1dfb8331f1b441972bc5941fa418cfee6139c15eda91b1ecf8887e108b15c4c7505c31efe205c875a7c854aa65bcc2e04ea6739f968547df4ae455ecd6b0566ef52705630df27d81e2a544ecc09f8c73cec559d206644acdc56c717e19f04613456b8d7a386c0a700c032d0165c3b3f5716aa7f24e6fca522f91350793d13ba7f887e7b48cd3e6e41139d0deb8de9aeac59bf750ce0000000000000000000000000f18d233cdc36efdead60d008963851bc819e1b4551b3f13bbf6c18ea0165c66f5261c9ec61f0914c6ffb8506596b61392aa5d906994608b36096a2f5c0f3fef95bf6ddb78c8d07eee5e815c9a2a3d21a054e6fd032be118e9a3f4d016db35b5048e20f1859680e5571822934769e6f9361babb4766dc073d1dabfb220daa1cf4e7206b2b8aa7b55d1396273690ec7a8d36ffbfe2a68a9547758d3ece744be07d320147c0e92e0b63f9b86ec19670ea43b7f596b347d8b9116506356d0279d21f6a0cab3056c27dec074e8dac12c1d99afcd84f82a47a0cb5093c7a221f7fb624e2f6e9eeca4e5050fc3be50bbdc62d41333b4243336a5590e4", 0x227}, {&(0x7f0000001440)="da752f575198baaac222d34e85893d37a6bd281687872ed9151c56f415698f3fecf56eebf5edb42ed5d54e0419b2a13128d3ad19b6eed6b450aad46baaa57203e0d4f567d8d79fe07e7b3142de43e55cf69c65db2469175cf60c82f49d0f9dc4c4dde733a14d57f4117ed2f46aea5950ff0176d73349c2808eee62ce1c7d846ffdf65211f3192dabe5b3ac1516ad90e618d0ca9e4ac2778acabeac244f2f90af2616647e5cf8ab5e2ac404ebf2a866c8a73f68ae2cc4523e63e3a1aa5ab60a23e4c47534bda546042120c5333d91fefc68226bc9149d282937797a2fe036a58c9ecd19e54bcfb85d3f75ec7c74d86be94ef6b9191e0fa86d2a9330af3f592e24bc30b84632e5121bf04abc0e12f4073f6678ad97b786cc73b8175e35eda542e3631d283a3ca6fef91607ec7dee1b4a62bae169cc8fb64e8bdef95474f0b3c526f69ce55281e18016a4785875ba99e313fd63f66cfd36234bcc6048f25bce8cce39cf709eb10e1ea88497ff7401aae0d4a7e07f14691b6c4b75dc16e2586744317ffbb9966d8bfb16efcdf6ab308426e5c1aec6a6636122ffaca89af3b03834612b93989d0bbb251a42c1b48b86ac7162ad8d5cbf3d6cfccdc590724ff6caa85320f9d5beea2370b8c0533c19422c9097a7164651ad9d8f9cca4ea7815e53fd9c42eab1cb76b451cd3b18cf31c16d01731efd1506b844f52d2f173c825a7f8814ada5f6361a48f20250df6b98965d0c85f3df3b72b2ac49f3ed52e6fa30d7d3d54d95e8bd13ec2ed4883feb3b778d624ff0c1a3ec900671acd0ff00edc7b96d1cad51fba25565c67ce0e62302dbff8f68c0de8330c44704b2f019a7afc753538ed61f3744f286735af18a8f5e7ae3fd66e4562565b31a9e5d947a06ea69ee5f0ea97d2e832e1bbc9e74498a2f99473ef8822ad0254013fefff6c4c35d84072307633de00985a6477ff6480e75171a50915838168d3b1a5864450cc9b2fb1f71364095c0fd0c94610e4b9785dc39501ba75496d10907ada3ffa622225897c79c8e8efa27396ada49844f7664bd2eee3a156c0c89fc8ded3f1b8be73d1e60521c2789837b71fe63a320f233032f2bc0472f53165423fb6c8755e5f18ac54ea180f0486914f917f8b16b13b286248c2ed33bf7b95efc5b3c15664d036fcb721d19011d09a7efbb4863b021bd7b75c632a2bb13676a1ab1fed3f1101196625c09244c987825b515d662f4fcac27b9a4cf92ba0683b7eecbbff92c7250bf7c04bcc660840d91620bb214b46581f7f406", 0x38d}], 0x2}, 0x8400) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x0, @local}, 0x10, &(0x7f0000000000)=[{&(0x7f00000000c0)="9d", 0x1}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001800)=""/4096, 0x1000}], 0x1}, 0x60000000) 7.372958052s ago: executing program 0 (id=1455): r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$inet(r0, &(0x7f0000001180)={&(0x7f0000000000)={0xa, 0x0, @empty}, 0x10, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e679e0e28b84961eb7b9c9b4fa916590965c76b48e5d453f27a821bd2bf0946ff2413ec30f7893d1f046e18f736c40ceda26dfc4a0a62f71a3606d3f72c0a858dfd7895e2572292e11af913c6b513a141d28e501ae7c49618d104aac9abb78466a636efb88120d0eef0a501558a5aa34784a9823f2802a0bcdf318f9b436b34b42a2a7cf513f80364ad9a699d2e23eb4f3a2bbce818bd20da61882b3dac699d05dc24f29b72471b712423ace6278c43df2be7a09e815517b86d8b3ce16af3d64a575958c5fd52aac53b391f3d2a67c24c6c13ec11428b61b80a6a58cbba1790a98d190a572070f63fc0b809669895ea9865c3066b06102f6f2c7171dc7f76e1931b3e4deb569ef9d07d5f86a848f50942e93c419c3a23489f14803b08182dfd48b8d4375be6b7f805a21209c05e5927693a8834c8d5a5acbd47ed8a30a8a741d1ad77639b56b3b90c0b2023fa334befd28b2e27cbcd94b0ce7437f88ce67a925cea6d6d7e5313de6d328b1124a8b9ef83fe39ca3da97d33c60b7fd4af67d3c8fccb595a27a5bffc71e5a5b2ec966828993b0c0f83cbc55f9a7fb66a4101d5c83b77885072b6e2b2ceebe32f635509698c05089b9ff1cb1959b211e114dadb224ef2d5e7a3c55b3ac00fcdc9018577603c6301e5d4341b3d7eeb2665349d448d28d5d108f576408cbe533a6adbba18ebb2d84bb9af81108506a2f50fb56d595579000747930449fdf4ed01715ec624a0cb73636a35b9136f10b79e3d7ded09008b92e92c64e26e6b6d17f18b70b1d9813de8d2ff151c7a6a0452c660a57c33f13e2d9b88fa5f5c0505722d2e787a425e4a3e9b5efa9668e9199f5fb9fe7d5b8a57719a57df152e7f2c6a1087a2a24084f82455b65353a70559f04d5ed12defb81497ea69c1c7e69c373524770b7473c16a69c7a3648a9dd93377b89cdff61cf62512d1ee67a55ea67993937c1f55a2179bc9c8a337364cfb84d295adda1ad9700fc2f5c11cbfc1b90affb4666c6e7e23a6f7751410a5651819f29f690c6dba2b8a67e0f7f8cc377feb1854c393578994c85391ba21b3961aed477f771645571dc7d6cae72bf79c82a92a4edc3742b1398060a0a5c9e81c016b7f2ae3db529c6ff824cc28678764d8ab49d7dc68e5b0556c9e7ffb6fef442776d86fbd458741830e57f22a1f8513b92abd5b2df93a67cc560134078f0b8ecc3276e40aadef5cd579888b86b4988f396679250701f3869e7493b33692035ecd94aca5189fd0a0893ccc5bb19c0b4caca86cf90ebc2a5558f39cccb33f6773a4e425bf551fb3b6456ee1cc62fa1843a9e5539bb2d02ae6ef82533a9dbcfb562c1ab18c1f639ae7ff02083746f74a15ba2d10e4b955940a5d6f488d326a99f287c48ad463ce40367aeeff519cbad0a2d7fdbfa48bff75955467977764c2be2bd2ffa18396c46920c40c50a4037003666406d177e2cd20aee423d07169d8f611f635ba0b62b61265ff2c5548446a2423dd1038482b6852b2d9d2f90aa05d82c5e2c3d1af0c7aad72d82b3da67471af7b037bb0424a785e73f35b5a10a2ab300a195c20cd119a5390e0cd5d49c70bd80883b933e843d0d2902749dcf3c140c708a0f004b7a2f50bf311305dc01719016fcce5863815ca7951de710fcb71cd177551ff6fcd9f8bf01b93868f24c6129b6d7917125338cf62110083093fc7f862015d48450d992f2bb43e601cab19b2ea7b83962a382fc2a31fdf2358bf8a9a9e506eaa7b6eb5e7444d1ef459b24ffa51362abce902dfd84201a0e4b5a3b62757aad54fb65b83821c6bba663886de092065a565921ea3eb6781bb8ed4f4db3abcfeeb379b7e52fca790bea719918e299ab01bf5e92177d134360bf7a16a59e9d03d3dcfb0a25599237e3d41b3f0026c9402b1fb1894426303413a2cbcf7c72807ca694afa285990d07c3bca26413c9947b3b344aafc04544b8c11416e0312b028da7302e316c3966d41884b15055a49a4a0b3eac8e11f88a5615fb0af582f065d28e5a454447e9d0cfc60356439ebf7e1d0a00f5b9cc6daf2bd7195ba96b4d1a0679ff0fb1c01282c378a880f90f460889b67d76d4d0e8db6c928d113533d1d10b810303c43d8ff622c5bab7f095b96e64bf9daa48a2bdf3d9d40bac00cf1b66df61a4f7c3e21938e876f81b1179dce6a008f28eb682cae690ced0ea0d542da604d8056f2b1813ed36683c4c51aeb2650772cfb1c55d4e60604ff06344cfc271b2175a6c94defb807af240b483e24298ca73bfc743ca2ca2e77e6d5b817b3c1986601537faf59ac84c74d8bd0c068cb8e6bd03ac2dcf5793fb4a00b3c901a33aa3ee86e4f0db317b94bb8678ab26e36d305ebac4b0f7f164947148255b562dd0f87648499d45bccfb7d8c9d5624cadf8160a396e79fbcdc100058ba4606e41c02fb2cc0dc6c36196bd28acfde82a18cda2321d2d83fecd3b85380667cd1d0bc68298c6c8f10421a80c8fa86912b6c3e8ddd9d9668520d5151409e6b77f0d7730b374a68a744151bfbd123cfdf871e8c24e70d2ca3b50e84a48e0b78c1781000cfc848d43584985763a76c0ab9ba882c55e3e4aa8f2174255db38adb8350b48a77be22a869d13d183325f859b883464e5e46de5ea8a92532b9a794daaeff657cd361f7f158f8bebe36e9de1f5b9721d4263dcc9472229bc02d3f552180abfb25ca7aa36cb914d99c09fd5bb99dcab9b4e3c634d18fc7dfe84dc4425ad1e39c3e7410d49b4ea0a8a2958688c7725822f6dfc0827d19dc385e0e35a949941e4dd1aaeaab9ebe402f8c584bca7efc829f2ccfb63fd7bde1c182a67c14f9d3f033ca674e2604e89cd55a15419f956cd61a755c1b13554dae98e77be078aadfc131c9677381f1dbe6ef194eb17603a463e8b844ab46a6046e1f07d96d66de669359bff4c3d80948a4de3abb2f171a09b5d8999c379fb62244114e218c79805df7d899e5661320ee6721d652b95f09e4dfe69bd67099c73294b17ab574e0b966aa3ab44478965b9dca3cb3b9282945f24ccdd07c638ae25a84a728ca24f87ff49d718121a694be46f3616e27b1041b3c6cd24b9cf775bfc28dfbe0a009048f0599f2d5d6586cfd1e7f7fe69872d08b98f60d28e6af0d49d7f06ad71a7b5c41df261aba5de114022c7288bc265cc17909fdeadc3d7b256d7ab3b96e40f857060f16b54a6bb7248ee571f87ace5ee39eab412706cf52fa711468b21ea129c3f44bceb429fcc1a0ac2aa87b9365077dcfcfa9a1b32a0a09699197c20019a66cbd0a897feab3706c23123b888ada643d4560082033e31596b0483578968e3c9593ebd97141c228a42fc7645f92171c120aabca36657683fd7c72fcb87217f124d6fabc52f1d221d8410b47b0ad4bd944bf4085365e9b52a53911ab4ee142c5a1ebbe034c9d98c538c066f2dc0acf372eb2397dcac765055123e0ba19be22b18c886bf0f7490abe9fde91ffa62e059962bd134be8501cb5b715a744b1398e2c4c7e8afe72e189dda0654296afa1c1f99ab7d800fa40f72a758625c833b6fc7b7d42250522b456e1e7de815350c36c9cb2f4d1c9cb99109f89b456c559463f11b8b58247809b17a4ed4912bd0a47a529f1364d6dc593ea7f3eb98962078ac90e5012ee1c7b4b9ed5a8c7a9c0231b4ce425693faab64fa0f3482a04d4be2e06ee5d103694d288810a1a7f4d1e908dd82dd2016a064ece5cd67ef1dd5f4cda728fc6f1ccdd949dd8f775d862621507248ef4c83ae274969d19c7ddb02a4e8a1ab2b7aa539a442b22735ceedeefe60a1059dfaaa0979ce8d5387b5a047841fd9749b88ca91216b02d7926408a01916b7781bb7167528ccdb9a486d173437a5ba3e552c8674dff2cc9b21054e0e4f86b61b8723fca58ceef4413bffae9e9be79c5b9788f5449811ce78be9bc7a86375a670197baaef751beabcba0aa6c7c33f1cd702cb78ec39fa1f17d9da733d6abf2b80f9c51ac8f6f664b24edc53a7c9525c3016bd05c67272375fe816b2b121f2de68b885a0fd8f8b8c6c342237b632f6414a3eb3480f5f42106c5812e9bfd4e8c8dea8d08525d9aa1da7c7c2ee7ff3d31b79b211dd01e304a8ffc83a89a59f3b1e2ef5e969b6d90bea7e161066f25622fad914bff52bacd2807093dda1838b529ee57f718b374ce2841b924a42457867547a6edcb8412d85f11796742bf640b5819a9546357df778c332af5983c4373a95d9c58b52dba445eee92e6911824f0c534e7a5934d9eac9b7f6fec22002fc53a3003a3304217f567b47cd326edc5f48eb1f46bb20d1e10e72239afc9769344590cf48902aba5405b7d4baa31a912ab398a2f2d3f037614bb56a89244ece50f3a1e058d274f1e70f944eb8a305be91e561e5eb843d057a81f4deb84a6335ec81ca964cdae5f318d4e9aaea2c477cc279c00c698bcfe4b8e04c09079d8f3f5438d9d45a00f50d2f9b245c8c68eebf247e25ba8d26f8b95b21ac9ceb50c0aa2e4bdc032024db216b92f9350a90ac79341af14d3fa8ba908096e1b503341aed667bb184c672dac85fc4f335b3871c3b4e55ea219a857d2d2e135358f6b45a20b3e7de8e09b2041eb7c5084a80258fb524a983752659298a251e178b56f96bc67ae0a78ec92f92d92c9cf0edb5dcb11e739d69410ad44c8df00caa030d7d89f2ec38bd7698115c423cf3e6048793aca08ffbcdac766f1553773fa00031c1d75246e4e1eddf8948d02a3de6d67fd7329e45070f29044587f1e0db50d04e673191a63e30f96ee0d8d52738fab36a7fe2c6ab9301d401e7ca5b1f039193a580e40abbdf40c2d7e27809dec80815d37adae9fe7fb9d3a974c9fc03944d7338d000b81170be4c6792ed6b3b827194b3ae11e2acfca48498d1126aacf80f3d574256ef7f75552ff087a819e", 0x1000}, {&(0x7f0000001040)}], 0x2, &(0x7f00000011c0)=ANY=[@ANYBLOB="1400000000000000010000002500000002010000000000004800000000000000080000000700000010000034366567f2219787566400007300000000000000000000000008000000ef3820f3439cb150a3651e799e1459c9c9a7521737a8879e3ef4dca1e3c32158996e4b2abde5342e22f2ba8b679121ac0b0ad62ade31fb2c47f0bbf781eb8bd1e3064141e90e9eac25b189c0da98b676571bbeefba392c3e15a10e03dee4ae1dfe99793e51ec0c6bb5fa6d7b357d249502f5919ef251e5d0e5bed378265b8bd55fde4689cb509b14fa754813a27e72d175e8d677420e10d651833e6e2ab8168b1d633b1bb9a7d4d59ebdc7083d93d35cd469de", @ANYRES32=0x0, @ANYBLOB="e1212f0409000000e70bcf35ac837225dd355ad309a5ec6096633ba38e1ef5baf006020e5f45c993cb5680017c6720bea9b7c451516a8cff7f00000000000019f20b784b2336d43c8a0f7347801a596dfb0b078a967980ccec1d115c7a0000000000000000000000fed6260fdf140498f1274bc569d0d87656d0d18d903580f0ec0915e89bd286b2c25165043f6a001d53f84eaabf01cc310ff28c7c76867ce1a2c9c91b1db7295614e2a4f8711ec37ae999180cb5bbb9c5382120076e117539d423a2ec0f468db35960831f5f884c1fa9f46b3472327697495b8e8ba8e2f3defbe93e1fc733b06dfc74890a3f63b154e9681d69cdd9894c914ee45c286462888ff84e401a6d8895ffda88a171b7359f815d7b6f7562fba1bbff4cba08f7a39a8e88b66a4717b3c318f85aecbe8b5f3485f8d31bf5a57b9dd53b382ec017a33d1fabe09daf76b3b0"], 0x6b}, 0x0) close(r0) 7.28147032s ago: executing program 0 (id=1456): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='h\x00\x00L', @ANYRES16=r1, @ANYBLOB="010128bd7000fcdbdf250100000000410000004c"], 0x68}, 0x1, 0x0, 0x0, 0x8880}, 0x9080) 7.119211655s ago: executing program 0 (id=1458): connect$unix(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000fea000/0x14000)=nil, 0x14000, 0xc, 0x11012, r0, 0x0) unshare(0x22020600) syz_open_procfs$namespace(0x0, &(0x7f0000000240)='ns/ipc\x00') flistxattr(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000040)={&(0x7f0000000100)={0xdc, 0x2, 0x8, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x9f}, @CTA_TIMEOUT_DATA={0x44, 0x4, 0x0, 0x1, @icmp=[@CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xffffffc0}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x8}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x81}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x60}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8863}, @CTA_TIMEOUT_DATA={0x4c, 0x4, 0x0, 0x1, @icmp=[@CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x3a98}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x379b6c6e}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x400}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x9}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x4ac}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8863}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @icmp=[@CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x6}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x20040004}, 0x8005) r2 = socket$packet(0x11, 0x2, 0x300) sched_setattr(0xffffffffffffffff, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x3, 0x1, 0x2e8, 0xc959, 0x4, 0x80000001, 0x5}, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000480)={'batadv0\x00', 0x0}) sendto$packet(r2, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x11, 0x4, r4, 0x1, 0x6, 0x6, @local}, 0x14) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xf4}}, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') r7 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r7, 0x83, 0x8, &(0x7f0000000980)=ANY=[@ANYBLOB="bcea"]) syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0) r8 = syz_io_uring_setup(0xd2, &(0x7f0000000480)={0x0, 0x7aba, 0x100, 0x22, 0x352}, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000000)=0x103, 0x0, 0x4) ioctl$SNDCTL_FM_4OP_ENABLE(0xffffffffffffffff, 0x4004510f, 0x0) r11 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x100010, r6, 0x8000000) syz_io_uring_submit(r11, r10, &(0x7f00000002c0)=@IORING_OP_UNLINKAT={0x24, 0x4e, 0x0, r6, 0x0, &(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x1}) io_uring_enter(r8, 0x47ba, 0x0, 0x0, 0x0, 0x0) syz_usb_disconnect(r7) lseek(r6, 0x1000000, 0x0) 6.611186089s ago: executing program 4 (id=1461): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r1, 0x107, 0x12, &(0x7f0000000240)=0xe9, 0x4) r2 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r5, 0x0, 0x2, 0x0) splice(r4, 0x0, r3, 0x0, 0x41c, 0xe) ioctl$sock_qrtr_TIOCINQ(r5, 0x541b, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040024}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000200)={0x40, 0xe, 0x4, "4321bb49"}, 0x0, 0x0, 0x0, 0x0}) 5.61808673s ago: executing program 2 (id=1467): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a0000904000001030101000921000800012203000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000001180)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001300)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) close(0xffffffffffffffff) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r2 = syz_open_dev$dri(&(0x7f0000000040), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r3, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r2, 0xc06864ce, &(0x7f0000000380)={r4, 0x0, 0x1ff, 0x0, 0x0, [0x0], [0x9, 0x0, 0x0, 0x8], [0x3, 0x20000000, 0x100, 0xd], [0x1000010000000, 0x0, 0x7fffffffffffffff]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r2, 0xc00c642d, &(0x7f0000000080)={r5, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4, 0x13, r6, 0x0) sendto(r1, &(0x7f0000000080)='\"', 0x1, 0x805, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCADDRT(r7, 0x890c, &(0x7f0000000840)={0x0, {0x2, 0x4e24, @empty}, {0x2, 0x40, @multicast2}, {0x2, 0x4e27, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)='lo\x00', 0xffffffff}) r8 = syz_usb_connect$printer(0x1, 0x36, &(0x7f00000004c0)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x7, 0xc0, 0xf8, [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x7, 0x1, 0x3, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x3ff, 0x10, 0x81, 0x3}}, [{{0x9, 0x5, 0x82, 0x2, 0x10, 0x4, 0x5}}]}}}]}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x201, 0x8, 0x7, 0x6, 0x0, 0x9}, 0x1c, &(0x7f0000000540)=ANY=[@ANYBLOB="050f1c000403100b03100b001003000300e50caae0c99d99cba0f7ff"], 0x1, [{0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x1849}}]}) syz_usb_control_io$printer(r8, &(0x7f0000000600)={0x14, &(0x7f00000006c0)={0x40, 0xf, 0xc0, {0xc0, 0x22, "25e023c37329c2eb632048ada95cc4cb68a3c89db0b2b4902afe08578949d79117f6c64914639b7da09f2f1f0f44d48304b74d1091570fe151aa8efcdb5617664982debd9dc853b2efcfadf936931ca30553a5a714ce02c776eff9ab17252972859fb7c2ab97c9e53eef48367a77c4d97dd6097a9237829fc5ad6bda153d9e6f04936c1e2943ac33db3a7e578049cca791e3f62fe099704a0733a280db227426f01173e60d1868ac3fe72529dc14ca8455a7d39f0e7327d6e966cb27af06"}}, &(0x7f00000008c0)=ANY=[@ANYBLOB="0003ae000000ae03d52c0c229a421cdb02eeb13eeba17cdd89892cbecf8af15b8a9e7f731806c5f817e27da21fa43dfdb19df0333392795bfcd2667f14fd1dbab814bbc5a125f9b0b92ec782ef8109691d49026b42e84d4787ee36dde4cc5d22a134d4f2099b817709b97041d4c624a4786464396c87b9c21d3643484ba3c2720a75c138f540d38ae36baa4dbecd10c19c67f9c04974550f04b6df3a6081faf4c496bd5bc9e11600"/180]}, &(0x7f0000000c40)={0x34, &(0x7f0000000980)={0x40, 0x17, 0x56, "75588ed02444dce53f9849550224b9d3f24a8220de1094538c3fe0b5f1038509484d61b09bc158987440f5f80ebc65d18c2138fe0af5291f59516f6fe4df21e3d28808eb8881ff074829508bdadcfe33f318b7338ee0"}, &(0x7f0000000640)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0xfc}, &(0x7f0000000b40)={0x20, 0x0, 0xce, {0xcc, "e18206fd8a748ea9f25a17a55d3a7e94b86506c748e63e2b1bc670afdaca89bd5f211136637b8ff869c77c16de640dbaac8f1baaf08d1940d943a0bc27d15b18a3db50c4d8d368084ed94fca1e6db94a3002c5f02196cbf6bf562ae42f21657d3caa788ec2552a19f5636a90114b660ed560346a0b866d103fd9946ff29a27402e52751b2153f476db12f30352eb5bcd4684e260b7918ce9704b988e108b312baf4a2a494d34d0f3cc94655239e74a6e4e6adf4f0c009aed9e12e293b99b56d56ed162485a47298525cef6b9"}}, &(0x7f0000000a00)={0x20, 0x1, 0x1, 0x57}, &(0x7f0000000a40)={0x20, 0x0, 0x1, 0xd1}}) syz_usb_control_io(r8, &(0x7f00000002c0)={0x2c, &(0x7f0000000000)={0x40, 0x22, 0x66, {0x66, 0x21, "6b4afd20e4f08741076ccaf45a3fd0152386bc96d52c0ce26a85ce82ba62f571378d019887aa657141964f981ff9241c8274e0463469f8743a26c4659769b6495669e174adac437ee42a9869babaa94b9bab9e3472dfa309480e8ff6b6e53ee669057fb4"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, @string={0x1a, 0x3, "d949430e42338b1a8ba7b975d45554b564151de378d16709"}}, &(0x7f00000000c0)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000100)={0x20, 0x29, 0xf, {0xf, 0x29, 0x9d, 0x60, 0x5, 0x8, "a9cdf46a", "b2a8db99"}}, &(0x7f0000000180)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x8, 0x1, 0x8, 0xf, 0x5, 0x1, 0x2}}}, &(0x7f0000001080)={0x84, &(0x7f0000000c80)={0x0, 0x7, 0xea, "ef85662e2ef9c09f63088e068e2b824b14f05eb236143e199737377f7fe90826c0458b136424509c1352a17efcffd14c1b54238b21393cc63e3bb4b45785540e8806622d8c3bbf1a5d37b58c15bc791a72575750684b6d1c20fa9cf799bc8b29bcab35ebb03c44b5ddb4cf809c45114b0f373d9fa5384b8bd08ce6a5901d3c869ec86ba33c01285d0bda95a8fb4fd2f24eadcc7e037a1d0ca6150ea80deb13c7a9bcabe9829fcc873e982ca6f5c1b4f4bc3e5a3aa884331ca3b4774cb369cf09d162c6c13e43399449ed6163e3433be4d126c40e954ff1c1f91545c6acf4b10f4f3b785acf0662b24b6a"}, &(0x7f0000000a80)={0x0, 0xa, 0x1, 0xff}, &(0x7f0000000ac0)={0x0, 0x8, 0x1, 0x40}, &(0x7f0000000b00)={0x20, 0x0, 0x4, {0x3, 0x3}}, &(0x7f0000000d80)={0x20, 0x0, 0x8, {0x200, 0x4, [0x7]}}, &(0x7f0000000dc0)={0x40, 0x7, 0x2, 0x68}, &(0x7f0000000e00)={0x40, 0x9, 0x1, 0xb3}, &(0x7f0000000e40)={0x40, 0xb, 0x2, "421b"}, &(0x7f0000000e80)={0x40, 0xf, 0x2, 0x7}, &(0x7f0000000ec0)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000f00)={0x40, 0x17, 0x6, @multicast}, &(0x7f0000000f40)={0x40, 0x19, 0x2, "b5fb"}, &(0x7f0000000f80)={0x40, 0x1a, 0x2, 0x1}, &(0x7f0000000fc0)={0x40, 0x1c, 0x1, 0x7f}, &(0x7f0000001000)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000001040)={0x40, 0x21, 0x1, 0x2}}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000680)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB='@0J'], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x0, 0xd2859f99480e5041}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000240)={0x0, 0x9, 0x6b, "881775958cf8b9d784ac36b3d7c7da362dafd2fadaba0d14ac1d6e69d8c941cc0e6e62760b1bcec40e18da231a4644c9b87a85db5ad8dcd58838699e9e13bdafd3674ab3396a5f1b00000491bbeaa57e5edff640be944814b6264c65f5e2950c4210e966ff73d48a74a99f"}, &(0x7f0000000140)={0x0, 0xa, 0x1, 0x9}, 0x0, &(0x7f0000000300)={0x20, 0x1, 0xce, "dd213d144def84191e282f8bf562cb6e03c5719d064d22fb6e87b2da0ecf18247784c75064de5aced41d801216a3f34dca4558a82f9f2b9e6b6c3e6888685471571c31ebcdc8e58e69ce26a3c6eedb78d03c20f84badec0329fa19c66c7b1b3450ef5f9bf6f94f94180e0cefdf1875d8e842555b563ca5afb9e41b332a23e1b0c443c61394954a08a1c19349da1a57bce7a051656e4722f13fe033050c24f3d2e586837c3e81798987da05cf124a6c017743c8e1550bc4df9d063b4f5cf37add363d6b05c4f2caa7eaf4b8601189"}, &(0x7f0000000400)={0x20, 0x3, 0x1, 0x6}}) 4.651241159s ago: executing program 0 (id=1470): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x275a, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000000206010200000000000000000100000005fa03"], 0x28}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0xffef, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1d, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd0007003219002bfd000000000000000000af1e4ccfb7b3cad800000800", [0x0, 0x2000000000001]}}) 4.546555892s ago: executing program 0 (id=1471): syz_emit_ethernet(0xfdef, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaa"], 0x0) socket(0x10, 0x80003, 0x0) (async) socket(0x10, 0x80003, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x161200, 0x0) (async) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x161200, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x3) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) r1 = gettid() r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r2, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) (async) write$dsp(r2, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) (async) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) fanotify_init(0x0, 0x1) r4 = getpid() rt_tgsigqueueinfo(r4, r1, 0x1f, &(0x7f0000002240)={0x2b, 0x1, 0x2}) (async) rt_tgsigqueueinfo(r4, r1, 0x1f, &(0x7f0000002240)={0x2b, 0x1, 0x2}) signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffe]}, 0x8) (async) r5 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffe]}, 0x8) read(r5, &(0x7f0000000740)=""/384, 0x180) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000000c0)) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000404f045db6000000000001090224000100000000090400000103000000092100000001220500260581030000000000"], 0x0) (async) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000404f045db6000000000001090224000100000000090400000103000000092100000001220500260581030000000000"], 0x0) socket$packet(0x11, 0x3, 0x300) (async) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x2, 0x300) (async) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r7, &(0x7f0000000300)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @remote}, 0x14) r9 = socket$packet(0x11, 0x3, 0x300) bind$packet(r9, &(0x7f0000000000)={0x11, 0x0, r8, 0x1, 0x10, 0x6, @link_local}, 0x14) syz_emit_ethernet(0x52, &(0x7f0000000300)=ANY=[], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000000b80)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="002205000004030000e1008d51a86bc66038649b86ee7bf03335f9c51dcbc34a5b1ae8b4b245d64cbc9bf438ee8b84dc89cadf1ab14b5cf18a4741"], 0x0}, 0x0) (async) syz_usb_control_io$hid(r6, &(0x7f0000000b80)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="002205000004030000e1008d51a86bc66038649b86ee7bf03335f9c51dcbc34a5b1ae8b4b245d64cbc9bf438ee8b84dc89cadf1ab14b5cf18a4741"], 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000002300), 0x0, 0x0) 4.304538237s ago: executing program 4 (id=1472): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_PIT2(r1, 0xaea2, &(0x7f00000004c0)={[{0x15c8, 0xc787, 0x2, 0x6, 0x0, 0xc6, 0x70, 0x0, 0x3, 0xc, 0xda, 0xf8, 0x3}, {0x0, 0xf3f, 0x0, 0x7d, 0x8, 0x7, 0x2, 0xc, 0x0, 0x85, 0xd, 0x4e, 0x6}, {0x4, 0x9, 0x13, 0xfc, 0x5, 0x7, 0x1, 0x10, 0x9, 0xf4, 0x55, 0xe, 0xffffffffffffffb5}]}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_usb_connect$hid(0x2, 0xfffffc81, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6161, 0x4d15, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4f8}}}}]}}]}}, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 4.040340326s ago: executing program 1 (id=1473): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, 0x0) ioctl$F2FS_IOC_WRITE_CHECKPOINT(0xffffffffffffffff, 0xf507, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) unshare(0x26020480) connect$pppoe(r1, &(0x7f0000000040)={0x18, 0x0, {0x4, @random="bb7fb37b9489", 'bond0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}, 0xea050000}], 0x3e8, 0x0) 3.823605171s ago: executing program 1 (id=1474): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000003300)=ANY=[@ANYBLOB="6c0000fd", @ANYRES16=r1, @ANYBLOB="01002ebd7000000000001400000018000180140002006e657464657673696d3000000000000008000300fd0f000005000b000100000008000e000000000008000900010100000500190000000000080009003500000005000c0000000000080011"], 0x6c}, 0x1, 0x0, 0x0, 0x104}, 0x20000050) 3.743125342s ago: executing program 1 (id=1475): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000) sendmmsg$unix(r0, &(0x7f0000000540), 0x0, 0x4040880) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140), 0x8) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e23, 0x4, @remote}}}, 0x84) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) recvmmsg(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x61, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r3) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x3c, r5, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x4}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xffffffff}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x80}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48000}, 0x0) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) r6 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x80402) pwrite64(r6, &(0x7f00000004c0)="2ad0f8654ad1097e98d1bbe495953836040e41cb0f6c783efd616c41a12ecc83b3c0fe64985caababc5d9d4ea437f5d1658a3435a10d038a78a8fb306d", 0x3d, 0x9) 3.56832116s ago: executing program 3 (id=1476): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x4, @mcast2}, 0x1c) r1 = gettid() timer_create(0x2, &(0x7f000049efa0)={0x0, 0x7, 0x4, @tid=r1}, &(0x7f0000044000)=0x0) timer_create(0x2, 0x0, &(0x7f0000000140)=0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x40100, 0x0) lsetxattr$security_capability(0x0, &(0x7f0000000140), 0x0, 0x0, 0x0) r5 = socket$inet(0xa, 0x801, 0x84) connect$inet(r5, &(0x7f00000002c0)={0x2, 0x1, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r5, 0xffffffff) accept4(r5, 0x0, 0x0, 0x0) setsockopt$inet_buf(r5, 0x0, 0x9, &(0x7f0000000340)="02000000020001000003be8c5ee1768810003c08030300ecff3e000000030000980000000098fc5ad9485b3b6a880000d6c8affc0c0548f682b4808eb5db0000dba67e06000000e28900bf030ff1018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff0601150039244611818478aa0f43dbc96bcdde66c3804759f0c1f64af38c46a57ddb3362be2003a81c6d0cecfd36b56da889c80b0407978f933c0e566c429cad06e7191be088222770436621da6293f6e245078865a718b086d8b49ef546759e852332b413f0b155da64ee1125da24f35d4035f2f5a42bda4c3fb6cd7cb2d2438a48937e", 0xd5) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x4) ioctl$KVM_GET_VCPU_EVENTS(r7, 0x4140aecd, &(0x7f00000001c0)) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(r3, 0xe54aef35e9c2845d, &(0x7f000006b000)={{0x77359400}, {r8, r9+60000000}}, 0x0) r10 = memfd_secret(0x80000) ftruncate(r10, 0x1) ftruncate(r10, 0x2) clock_gettime(0x0, &(0x7f00000000c0)) timer_settime(r2, 0xffffffffffffffff, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) listen(r0, 0x0) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r11, 0x1, 0x8, &(0x7f0000000140), 0x4) connect$inet(r11, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r12 = accept(r0, 0x0, 0x0) shutdown(r12, 0x1) recvfrom(r11, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x0, 0x0, 0x0) 2.53903214s ago: executing program 3 (id=1477): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002140)=@delchain={0x104, 0x65, 0x20, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0xd}, {0x0, 0xffea}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_route={{0xa}, {0x48, 0x2, [@TCA_ROUTE4_ACT={0x44, 0x6, [@m_vlan={0x40, 0x6, 0x0, 0x0, {{0x9}, {0x14, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x1b6}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}}, @filter_kind_options=@f_bpf={{0x8}, {0x7c, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x64, 0x1, [@m_nat={0x60, 0xa, 0x0, 0x0, {{0x8}, {0x4}, {0x35, 0x6, "455c01c35a2bca70225b757b65e5e4a3d41b6fb981e9f5ab2f14ad001cda09785441b436361246e3000e13fa20bea090aa"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}}]}, 0x104}, 0x1, 0x0, 0x0, 0x80}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}, 0xffa1}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 2.212430881s ago: executing program 2 (id=1478): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000640)=0x10) ioctl$SNDCTL_DSP_SUBDIVIDE(r0, 0xc0045009, &(0x7f0000000080)=0x1) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/llc/core\x00') prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) fstat(r1, 0x0) 2.212152039s ago: executing program 3 (id=1479): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={r2, 0x44, 0x4, 0x1}, 0x10) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000300)={0xfb1d, 0x6, {0x0}, {}, 0x3, 0x1}) syz_usb_connect(0x3, 0x1b, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002c2bae310c00900023c5801029a620902090000060780ff"], 0xfffffffffffffffe) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@private0}, 0x0, @in=@empty}}, &(0x7f0000000440)=0xe8) getgroups(0x3, &(0x7f0000000480)=[0xee00, 0x0, 0xee01]) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000004c0)={'\x00', 0x9, 0x4, 0x80000000, 0x1, 0x9, 0xffffffffffffffff}) r7 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0x5) ioprio_get$uid(0x2, r8) lstat(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x3, &(0x7f0000000600)=[0x0, 0xee01, 0x0]) r11 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r12 = dup(r11) r13 = dup(r12) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r13, 0xc0305710, &(0x7f0000000000)={0x1, 0x6, 0xd, 0x0, 0x200}) r14 = getpid() ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000640)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0xee00}}, './file0\x00'}) sendmmsg$unix(r1, &(0x7f0000000740)=[{{&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000001c0)=[{&(0x7f0000000140)="a2614ffea410f44970d0dd465507b7a4fe96fbe97c04758e5b2bde2d814919020952", 0x22}, {&(0x7f0000000240)="bdfd895500ddc7fdbedd862afef8ae9ebea3e21ce00843d1bdfb65179da291e931688a23a28a43d6b351484d5e839f907cd96da84197724fb4b2447e0f919dd895c0265e071d3d08eea554828f87552baa872e182b91527ccf8c455f9a5d046825f8d23704591d68f46286dd9d281e7d1f3c8688df5f7df99fe69150056a50c0ad52545d0fb890adee08e95aed49", 0x8e}, {&(0x7f0000000180)="da707ee3e360387f51ae36bef4de876b7836defa0c3a620c0f23b62411d08bd248294198071889959bba5866b96f7b4245de174924a5", 0x36}], 0x3, &(0x7f0000000680)=[@rights={{0x1c, 0x1, 0x1, [r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r3, r4, r5}}}, @rights={{0x28, 0x1, 0x1, [r0, r0, r0, r0, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r6, r9, r10}}}, @rights={{0x18, 0x1, 0x1, [r0, r13]}}, @cred={{0x1c, 0x1, 0x2, {r14, 0xffffffffffffffff, r15}}}], 0xc0, 0x4001}}], 0x1, 0x22000000) r16 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) r17 = socket(0x10, 0x803, 0x0) write(r17, &(0x7f0000000300)="1c0000005e001f3814584707f9f4ffffff000000010000001ff80000", 0x1c) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES8=r16, @ANYBLOB="00e500000000000000000100000014000200776730000000000000000000000000004c00088049"], 0x74}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) 1.499170985s ago: executing program 2 (id=1480): bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0x0, 0x0, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f0000000040)) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)={[0x100000000008aba, 0x4, 0x1004, 0x804, 0x4, 0xc, 0x8000011fffd, 0xff, 0xffffffffffffffff, 0x9, 0x8001, 0x8000000000000004, 0x0, 0x6, 0x400000000000006, 0x6], 0xdddd1000, 0x14b200}) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x8, 0x3, 0xdb, '\x00', 0xc0b5}) ioctl$KVM_RUN(r4, 0xae80, 0xfffe) 1.319816818s ago: executing program 2 (id=1481): sendmmsg$unix(0xffffffffffffffff, &(0x7f0000013bc0)=[{{0x0, 0x0, &(0x7f0000001b00)=[{&(0x7f0000000700)="61120d30412baa425595ecdb2fab1551094e0a612820aef5c2058110671fdc6a330c21518fd5e1b5a12dfecc1020f000b038a6c60eccaaa7acb39ddc6022f30c9ce52415488705d117672b428a93b97288be4fcb5fa6859017669b9e8ee11564a9d8e3cf400c514c9ddc3d872d8e6fe96b1fb78ec44631c2fda7dd4e7aff7af4c1752518881b5a18d54187b1f2c4e46fb035febd3676990d0cc3a62d6098d65648bcb46ad1ff936868852e42b8dbe4c342088c327a2288b12325734293c609ef19c0a383f0dd3cc3add60d53c9b1678cad19fcf49420acdcd5f326bf89822b7b43b70d77e752c35af1949d489decd48aa9a37e895237a7bf897939dd0ae885cab13fc9dc3b42a6cb3bf44c980664325e937f49900442d5df7f131829542e7def95cd5c678155a3f8097419575f6742e783a8e9ce3172180f7205ff8808cfcb08b481929438510a7fed929a04e449b59920b508c491ba4271ddb35c2054df39c0734e96f2f38d41a0bdae815e0c2b1412cf2bd89be68640f7c7e8e89e5b4ee19b11581cf802475775b82714676eeefa98a2a480e953d4f639e417a06123c5764d5c68475fb03eae63360b7da8f6d64c4021e5d4cf52472d822f083aa9be4741e48cd4ee55ef91923544c6ae032143302589c28f4fedb7f95decbe7acb6a4092fd6963b27660955cba6d470ea64f2993b4ada9e956cf3d7d56bf271e68a876ce0f28071393d1b08d9b97f5de6ea8bf5867e2b147700b5647dd5a6ba345cd5fcaf256e045d1c23a297203b9f984178a08892cd6d69c6d2675ba54a0ddfd7c0c09825e2c65ac634accefba756afe8711c0de7b25ecbc54b3301e3376e4d6e44ced17ac2de64aef3cfc9806c98e8bcb6a31430e7eb0bf12a18303a63fbee97de895471ef17d6870c83ce125c5b5f9be4c4f92d3b71e2bc5adee04295603748a62fb967dc6bac87059a60da0105a2af4dd38fe0bac34a60535cec6c9d2aa0b890c3af61905b515dba493cb5e6d8f67372d31ad034362b29c21548fdc221528029b38f19baeda176a47cfcf9f74706d904eaf42336821e8ecf9a3687e14756e3e257fdb706214bb5662a5e6dbee69d7438d391117b53a8db65961b1c00b377235b2af71278635374d481af4b367bf6cf734eb770b53d4daf26e17fe662a78830743064b41394ebeee3080674ef1e97ae95097b226ddb5b8e40b095668f45375e70ddc721d450127fefb7e6b12800eeb3a16aa8196f6bdea8cc51b7cac1ff3e2ba4859c6106be53215b69a8c78bf961e50bfd019ef08c0aedb88d7aee7244dbdc889540313664b567cd02ddc97c35ae8bd3ffb1b4c868a4b82b3ca83c1fc30ae0a2e9dac4da29e273347d68c744b30b7369e1f0a22f2a09c9c1c9c5ab3470beab618c94205203c65faf4960db6f08a8417fc34da961b972eec6080b4e73fd69333069c0cab7ac7d1279a5cd974fbbd6c448b66a1c04432660283e4d5ee1598271f8571c6e5060b291f488ea6786f0e59b566d73833b7d522ee47a607b32e3329ad893255dbbec9346f4f29854674d0c7ac9af7b3f52a901efb6c86408e6d5992f1b860bfba3971866872a6a14c4762fb353f74be2364b60d7e46d9d9d7b6c5db4a04090062dcc88025b6371f35a6a30a6dc2d2859de70752588a71ee2d55bd122b59422f4555b424f9a87791235223d5cf8967d029ff22a009acee61527b993f34ab56a84932d079887f4bd14d5088fc183b72ac2bfd62b0c9b64a7ccc3234ad9fcce53dfca05a1164d8fec1206940c93605aa9cf9244b0213e9f8bf63b96514e61292b1a050e40887936e21c5416aca706b05a8b8e021cc07f56026ab1f0746797f817fa6765a0e0b964e43437e7dcf555032750a48b8a74a74d76bc88d9710f4ed5773e60ece4069be16457b239bc4785dcc66bdfca7b52e12b7a899bce20eed2c7568150ae5e680a152622ff7459d1f2bca7875f5c727e0ca2367ad84b997ade4b09c45599c0356983b8d419623bc10367c1454", 0x591}], 0x1, 0x0, 0x0, 0x40000}}], 0x1, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, &(0x7f0000000400)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfffffffe, 0x97, '\a\x00'}) mprotect(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x5) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$bt_hci(r1, 0x11c, 0x4, &(0x7f0000002080)=""/4104, &(0x7f0000000040)=0x1008) r2 = syz_open_pts(r0, 0x0) r3 = dup3(r2, r0, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10) bind$inet(r4, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x10) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000080)={0x0, 0x1e9, 0x3, 0x1, 0x9}) sendmsg$xdp(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000480)="fe", 0x1a000}], 0x1, 0x0, 0x0, 0x41}, 0x0) write$cgroup_subtree(r3, &(0x7f0000000000)={[{0x2b, 'net'}, {0x2d, 'devices'}, {0x2d, 'net'}, {0x2b, 'rlimit'}]}, 0x1b) openat$sw_sync_info(0xffffffffffffff9c, 0x0, 0x101000, 0x0) read$usbmon(r3, &(0x7f0000000340)=""/126, 0x7e) 1.140274351s ago: executing program 4 (id=1482): socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$loop(&(0x7f0000000040), 0x7, 0x20080) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) r2 = epoll_create1(0x0) r3 = fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={0x0}, 0x18) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaa28bbbbbbbbbbbb8100130008050008fba2f1ff80114502115efa2edffe20909cab2da7c0ba8cc356fcdb482522b4556c46525a96e82073a9b6b5f9dba7f68e1ecd9b71d2615886c26b036bef2c5ce88ea55818abc98ace892033dfe821fa6263b648e2bd1fcc2e0f5a7088bd59ef54b91786f90f4626bc0354772299c9f233ce5adb163551a7ddac800b260e2f6292f759b1c6d989ec426715c65ba9cf973a7e49e4b6f54604fbba3365a07a633ed28698b5c434c4471220a689de64daf971f59411d7817345022709517a6053761f3f47955e874af7937655040a3a3f8cec47600993fa805d636224abe60e801c7df17ad371079d2743d3576b534ff18a50f4b8c2da2a16a99c582485390f5e9f62dc8d9e90bc077a5113046beab53b4a5ffea8cd89665ba5cc3a1c4b5bae165394d4241a418dc0c49351300d4f46e4f247cfee98d2a92096a6be0b185937223903929374a9f87e11ccc2f010bb450effd5965b3b0f2dd2761748dce841535b230b386476be3671352a8048c793c1824dff7cc3239735c8212404f1aa4f3dd8622c025c38391737a2cb426b4b696f7dccab7c0960368af0ac23248ad6bd7fadb28db17348"], &(0x7f00000000c0)={0x1, 0x1, [0xf74, 0x8bf, 0xe4b, 0xa20]}) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) dup(r4) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r6, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000003c0)={0x48, 0xc, r1, 0x0, 0x0, 0x200000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000000)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000}) r7 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000090000402505a8a440000102030109021b00010100000009040000020701010009050102"], 0x0) syz_usb_control_io$printer(r7, 0x0, &(0x7f0000000000)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) syz_open_dev$char_usb(0xc, 0xb4, 0x2000000) syz_usb_disconnect(r7) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYRES8=0x0, @ANYRESHEX=r3], 0x0) 1.080264568s ago: executing program 3 (id=1483): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000000)={0x0, 0x400, 0x101, 0x1, 0xfffffffd, 0xffffff00}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000011c0)={'ip6tnl0\x00', &(0x7f0000001140)={'syztnl2\x00', 0x0, 0x4, 0x10, 0x5, 0x401, 0x0, @remote, @remote, 0x10, 0x16, 0x1, 0x5}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001400)={r0, 0xe0, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000001240)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa, &(0x7f0000001280)=[0x0], &(0x7f00000012c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xf9, &(0x7f0000001300)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000001340), &(0x7f0000001380), 0x8, 0xe5, 0x8, 0x8, &(0x7f00000013c0)}}, 0x10) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='loginuid\x00') write$UHID_INPUT2(r3, 0x0, 0x0) r4 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000001440), 0x2c4000, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000001480)={{0x1, 0x1, 0x18, r0, {0xee01, 0xee00}}, './file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0xa, 0xd, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x23}, [@call={0x85, 0x0, 0x0, 0x2e}, @map_idx={0x18, 0xa, 0x5, 0x0, 0xd}, @map_idx={0x18, 0x7, 0x5, 0x0, 0x7}, @call={0x85, 0x0, 0x0, 0x1f}, @jmp={0x5, 0x1, 0xc, 0x4, 0x7, 0x50, 0x1}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0x8}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}]}, &(0x7f0000000100)='syzkaller\x00', 0x1ff, 0x1000, &(0x7f0000000140)=""/4096, 0x41100, 0x41, '\x00', r1, @fallback=0x19, 0xffffffffffffffff, 0x8, &(0x7f0000001200)={0x1, 0x5}, 0x8, 0x10, 0x0, 0x0, r2, r3, 0x3, &(0x7f00000016c0)=[r4, r5], &(0x7f0000001700)=[{0x4, 0x1, 0x10, 0x4}, {0x4, 0x1, 0xd, 0x8}, {0x4, 0x4, 0x5, 0xb}]}, 0x94) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001540)=ANY=[@ANYBLOB="ac00000012000105b43000"/56, @ANYBLOB="00000000000000000000000000000000040002005c0001"], 0xac}}, 0x0) 944.262174ms ago: executing program 3 (id=1484): unshare(0x2c020400) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000940)=0xffffffffffffffff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) setregid(0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r3, 0x7c81, 0x0) unshare(0x2a020400) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/cgroup.procs\x00', 0xa000, 0x1da) r5 = socket$inet6(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000002080)) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, 0x0, 0x310) setsockopt$inet6_group_source_req(r5, 0x29, 0x2b, &(0x7f00000005c0)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e22, 0x0, @empty}}}, 0x108) read$FUSE(r4, &(0x7f0000000040)={0x2020}, 0x2020) close(r4) r6 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) fsopen(&(0x7f00000000c0)='hfs\x00', 0x1) close_range(r6, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x17, 0x0, 0x0) membarrier(0x10, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00'}) 742.336584ms ago: executing program 2 (id=1485): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0x4000812, 0xffffffffffffffff, 0x8000000) syz_io_uring_setup(0x3, &(0x7f00000009c0)={0x0, 0x3f0f, 0x800, 0x3, 0x3a3}, &(0x7f0000000940), &(0x7f0000000a40)=0x0) r3 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000a80)='./file0\x00', 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000b40)=@IORING_OP_MKDIRAT={0x25, 0x62, 0x0, r3, 0x0, &(0x7f0000000b00)='./file0\x00', 0x1, 0x0, 0x1}) sendto$inet6(r0, 0x0, 0x0, 0x2004c845, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000bc0)={0x1, 0x0, @ioapic={0x8080000, 0x80, 0x7, 0x2, 0x0, [{0x0, 0x7, 0xfa, '\x00', 0x61}, {0x6, 0x0, 0x0, '\x00', 0x9}, {0x6, 0x5, 0x3, '\x00', 0x9}, {0xb3, 0x81, 0x9, '\x00', 0x9e}, {0x0, 0x52, 0x2}, {0x7f, 0x0, 0x1}, {0xb, 0x10, 0x2, '\x00', 0x5}, {0x8, 0xfb, 0x5, '\x00', 0x6}, {0x8, 0x1, 0xfc, '\x00', 0x6}, {0x4, 0xa, 0xe1, '\x00', 0x4}, {0x10, 0x6a, 0x5}, {0x2, 0xfa, 0x2}, {0xb8, 0x11, 0x5, '\x00', 0x3}, {0x1, 0x7, 0x7, '\x00', 0x4}, {0x2, 0x8, 0x9, '\x00', 0x40}, {0x9, 0x9, 0x8, '\x00', 0x10}, {0x3, 0x0, 0x5, '\x00', 0x4}, {0x16, 0x4, 0xfc, '\x00', 0x2}, {0x9, 0x0, 0x23, '\x00', 0x71}, {0x1, 0x3, 0xb0}, {0xb, 0xd, 0xff, '\x00', 0x1}, {0x1, 0xe, 0x3, '\x00', 0xc0}, {0x80, 0x4, 0xe3, '\x00', 0x6}, {0x7, 0x2}]}}) sendmsg$DEVLINK_CMD_RATE_SET(r4, &(0x7f0000000b80)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000e00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="0100ffffffff000000002f000000d4df207b1feca0cdae343d4aa1c8af8f27a360b1729fd09204b5dfe8bf4983282d39955f27278ae0d648690d960374a7f440dbd9c0f9a513fc92a3cabcd2569b88a5504afe11eddc01982059beb4037662a67c402f4d495932c03aaefe1a0d58cb8d07838d1d95e8812d45be0f94175cddca2864424527202f06b6ce0b0fbe22d591b73e9bb238f717eed8909622b3ffaad2bc0ea73ec18b0e072fc376fb53e11b01282714ae"], 0x14}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) r6 = socket$inet6(0xa, 0x3, 0x88) openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x68000, 0x0) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @loopback, 0x6}, 0x1c) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r7, 0x11, 0xb, &(0x7f0000000680)=0x4000507, 0x4) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r8, 0x107, 0x5, &(0x7f0000000040)=@req={0x0, 0x8, 0xf69, 0x8}, 0x10) syz_emit_ethernet(0x83, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030086dd601b8b97004d88c19edace00000000000000002100000002ff020000000000000000000000000001"], 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0x2}) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f0000000340)={0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x800080}, 0x1c, &(0x7f00000008c0)=[{&(0x7f0000000380)="ff92fb55f8c21f58c20c9189a3e353d6047e7dc09c00a208a78e748e0ebb8f71b3d6d584e29a6e4dc152b75527f0c7babbeba16ba9ce03fcf8", 0x39}, {&(0x7f0000000480)="9f0c922f0dc6b89aa5d975d58d33f9a7ab22af25ebc1188f87e80c01da77e06b0ca3682575d0fb92abfe1a49b4eb3a11bcebaff3d2029832186be09269c3a8616b63535d303165b2ad06ba6091fb8970b70d7cd0f4379a4367b6fffef2532657e81b887ad4a749dfaa1ce0cf365d6e956c931a9260eedc286287c855", 0x7c}, {&(0x7f00000006c0)="cef84e4e25f6cf40eeccb1b8d0b88bb244e59397b4d41bb3c4014b50c17f361565b2549886b27da466a62e967ef5f6d25fe6d28bd075b6481b439e3e5f620b9b2fcae78e9082f2235d66d0676e2de18a72ab39c93ce26b423681a6ede17727863ef84e11a512364b8ee734b71bca4ace7cc4f1e6d2a8f29f1c082682baff3548e819a170674849bf11924c144d72e73504b3169e97305c38b4cd6d894ebea1fb3a797b6bd423071415f216239b4ce5fcce135aaecec23f223a8e020c683bb7f8f0fcca1905839f006e54876928", 0xcd}, {&(0x7f0000000580)="704f926d1bd789a5a25cfc6fc5c5a728fec672949c5e096fa9faeba4989e56a4b6447c21fa231e52d412c5ad2ab1585feca5163e8f2397b0ccad6439a54b53a4b8edb694d772cf6c58c242c618e7767cd2803441b613df706862056284e934f6989ce544fac6231bc5a5b042e12389558685b5e60c2b17f31f6afdaf24f317d444fcda3751ab1849f0d606dc542c0184f7116f0e3b6e6359277ec1761a5598ca78e4d751d307cde45cd9af38eb09e52c89f2c1864910e6df9774a5771d", 0xbd}, {&(0x7f00000007c0)="3cb0580871d49583fb3052d3072b1b698973c6509e292bb13176edc64c5a4f2a9e1ecd516f53a1c8b115951eca2ac1740a8aa3cc62a498c304d4fd4fcebaf20c20e0c484d5f065", 0x47}, {&(0x7f00000003c0)="5883624e9ac15d7ce2c27ae290234a7bd1d2fcf8bf4fd32176987f5d7698f69107ed7f0f7ec2b05aaca196cb1eb1fdd32c0e6116ec6a1cd855091092bb", 0x3d}, {&(0x7f0000000840)="8ef7a369f4b5101c4113c409d8fed8ec3ba2571470e733e0fc0436eeae22d71e620454d70f8bdeb397b67713f61ecb9ced255f18a20f02c5e28580783e911ec11a", 0x41}, {&(0x7f0000000ec0)="fb073f76a733539cd9c0e6cd934abf2e20ec0615a18ed694e0de45698ba923d55721285b72cf82f6516afe7dcd7d5e0450ac339b8a6f2e2ee2db44135c7d92fc0058012235b33abb11d11909f6c45b37c53886052e5f263d482fdf6281b596f0ed9a0e9a59c2d9cc73452dabbd10e6f9736ae976652a486689b63547097ea2986979425cba6d15866d85f15598434fe7a91029b86f5f67c0dccf43039caa9744bf0ded75c120f32b26179a16bf52044b51b8", 0xb2}], 0x8, &(0x7f0000000f80)=[@hopopts={{0x48, 0x29, 0x36, {0x84, 0x5, '\x00', [@padn={0x1, 0x2, [0x0, 0x0]}, @pad1, @calipso={0x7, 0x20, {0x0, 0x6, 0x15, 0xfff, [0x7ff, 0x6, 0x32e]}}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x1}}], 0x60}}], 0x1, 0x2004c000) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r11 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/cgroups\x00', 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r11, 0xc018937e, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r10, {0x2}}, './file0\x00'}) r12 = socket$key(0xf, 0x3, 0x2) r13 = dup3(r10, r9, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000540)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r13, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs], 0x0, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000001000)=ANY=[@ANYBLOB="85000000d00000007600000000000100270000000000000095000000000000000000a58fc9093e220f8900f3c474313bd69170d74a50a7eaa3da9dbfc07698cc25105bd66a97a236bc41073b6ecef48f2560cbb52ac44b7eb68c77a63aa393ad73bc07000049e4b4fe", @ANYRESOCT=r10, @ANYBLOB="ef3df1249cbeefe6366bb8c26f68a4dd407a71b353daf2182e204ca3035e9a31208edad5a2adbed30f24c390cfd6acd1a9fbb18623739e48dda713eea927fd73e3fbe7945cf5b51d7494d0474516b45b79c7a5", @ANYRESDEC=r12, @ANYRES64=r3, @ANYRESOCT], &(0x7f0000000040)='syzkaller\x00', 0x2, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7fffffff}, 0x94) 646.205662ms ago: executing program 2 (id=1486): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x3}) r2 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r2, 0x20, &(0x7f0000000000)="0900bf65653f47f4020000008bd458d1e7cbdaf300000f34e7e4165f081ae36850f6d15c3e681411f7a496c0da04003c242f5bedaf6bec340dee49474362b24cb800edc500", 0x0, 0x48) syz_memcpy_off$KVM_EXIT_MMIO(r2, 0x20, &(0x7f0000000000)="716f88cabc9b050a4c2efb7448850c573ebdb4d52efd8e8e", 0x0, 0x18) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x161281, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "a05c7b5d3cd1b0f200002000fdf700071400"}) r4 = syz_open_pts(r3, 0x0) r5 = dup3(r4, r3, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r5, 0x541b, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x0) mmap$KVM_VCPU(&(0x7f0000a32000/0x2000)=nil, 0x0, 0x1, 0x80010, 0xffffffffffffffff, 0x0) r6 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000001c0), 0x440, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYRES16=r6, @ANYRES16=r6], 0x50) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000200)={0x0, r1}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x8031, 0xffffffffffffffff, 0x1e0a4000) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000840)="d6964791e7a2b1229905624ce6897bce206cccd65dfb065d8a564c7617fd8d270c6b580ea2fb4ecf0087567f874db2e412523b6705073c24407d6bbbfb20fae3047a7670f95a4a90299c2a31e35f881c441f7bf106a68619264f3d8c198dfa8d6a3e5bb16abbd843615a72a9c1588a31c4fef25f257d9b57f1dd316a6657c8753480575b7a6a0602f5bbed9f3b756540192c24bc1dea483bcd88392cf347ea6908e7a363c2f3c7b158437fa00e003095", 0xb0) r7 = io_uring_setup(0x2ed8, &(0x7f0000000280)={0x0, 0x6842, 0x800, 0x2, 0x12}) io_uring_register$IORING_REGISTER_IOWQ_AFF(r7, 0x11, &(0x7f0000000d40)="01", 0x1) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73f72cc9f0ba1f8483d0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r9 = syz_open_dev$vim2m(&(0x7f0000000740), 0x15, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r9, 0xc0405602, &(0x7f0000000480)={0x13, 0x1, 0x0, "8eb8a83fe93b07f1dd06da7a41bfeac48048beb159fbba17425ced8f098c68d9"}) syz_clone3(&(0x7f00000002c0)={0x40000000, 0x0, 0x0, 0x0, {0xe}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000680)={0x24, &(0x7f00000003c0)={0x0, 0x4, 0x55, {0x55, 0x9, "48488e213b0680572c7c846242c106544d9f60d4703bf8aef1a092345c0183c0ae8a55c7e6960d9447094ae411c5c393e891c9bdac050a64522254931b688923dd845168057c99902ec5e63852a7e2796c9a8c"}}, &(0x7f0000000240)={0x0, 0x3, 0x28, @string={0x28, 0x3, "f0adbd752f9d10dda3eea791d44b1869e43475f5fb1cf60c7a6342ba6a8ce07451777606c613"}}, &(0x7f0000000340)=ANY=[@ANYBLOB="0022f9d78611"], &(0x7f0000000440)={0x0, 0x21, 0x9, {0x9, 0x21, 0x6, 0x1, 0x1, {0x22, 0xc13}}}}, &(0x7f0000000a40)={0x2c, &(0x7f0000000780)=ANY=[@ANYBLOB="20159a0000007457ed295cac321c2777691cd3e2bc408a1a61496918da5c1a000a38c9056e91161ba5fd4289bb1b01c1af71bd97bb727fb94ae3f6503f6dba220a8e2763ba84df1fde427f36bb3f9eb09977cf59dbdefd690495d6116992d25cc646c1a28eabfe3013f3b769794109b0a4d81874d7b7a94e5f1574221f4575fe86433a89a1876be37837aaab4b322994b9ef05000000606d5aae30cad8929ae8"], &(0x7f00000006c0)={0x0, 0xa, 0x1, 0xfe}, &(0x7f0000000700)={0x0, 0x8, 0x1, 0x4}, &(0x7f00000004c0)=ANY=[@ANYBLOB="2001000100009daa122bf4ec9dcf068c7502c736859da76fbcbf75ef4a1cf8491f388b8cef6345f7bcd2611059f23c0c648e6d2927dcc0159b876fd4f28b848e73dda40d10328ba303eef785b898043f1c0249c7650ba073defc9f72823bb202d73966688b10aaea18344001ee52a7bd679363d29a66fed2696dca08ead4f207b478a3a8b192324706a451d3690748e98b70a809b999b0e2cba0f4124cc3074056430fa50c5097706b953ef544de6a3c1d25f9495501f9fe91f465dc040000000000000091dc8fc64271415c210bd9143a47a8201f85724e99193ee24a1d544e28e43751441d106119b37b14e4b43827b2c9b8008e3550acdc19e12485df051e8ad18a146a03d60000000400000000000000000000006a453743daf35ae40eace5d673343e82954b40efaec5592f18440c78e8"], &(0x7f0000000b80)={0x20, 0x3, 0x1, 0x8}}) close(r7) keyctl$clear(0x3, 0xfffffffffffffffd) 603.270733ms ago: executing program 1 (id=1487): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x10400, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x4008032, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000200)='./file0\x00', 0x1000, 0x80000001) pselect6(0x40, &(0x7f0000000600)={0x0, 0x10000000000000}, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='comm\x00') epoll_pwait(r1, &(0x7f0000000280)=[{}, {}, {}, {}], 0x4, 0x2, &(0x7f00000002c0)={[0x4]}, 0x8) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002240)='/proc/key-users\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000000180)={0x2020}, 0x2024) lseek(r2, 0xfffffffffffffff5, 0x1) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000140)={r3, 0x2}) ioctl$DRM_IOCTL_LOCK(r0, 0x4008642a, &(0x7f00000000c0)={r3, 0xc}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@delchain={0x100, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0x1}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0xb4, 0x2, [@TCA_BPF_CLASSID={0x8, 0x3, {0x0, 0xfff1}}, @TCA_BPF_ACT={0x94, 0x1, [@m_simple={0x30, 0x1e, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_simple={0x60, 0x1e, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_DEF_DATA={0x8, 0x3, 'bpf\x00'}]}, {0x29, 0x6, "9787c29d6ac649e7ec160dfef7c4cea330102e688fe12213d2bf7dae04880a34e7bf775010"}, {0xc, 0x7, {0x0, 0x79d0f023c2b305dd}}, {0xc, 0x8, {0x3, 0x2}}}}]}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FD={0x8}]}}, @filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x100}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f00000000c0)=ANY=[], 0xb0) connect$pppl2tp(r5, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x9, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) writev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x34000}], 0x1) 444.370855ms ago: executing program 1 (id=1488): syz_emit_ethernet(0x3b6, &(0x7f00000003c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff86dd60122d9a03803afffe80000000000000000000000000000aff02000000000000000000000000000186009078000000000000000000000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff2e616064f68fbc32025745f45d1923732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af180200010000000000000000000000001818fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934da4731f3f61effc978001d06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4"], 0x0) r0 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c020000", @ANYRES16=r0, @ANYBLOB="01000000000000000000010000021c00020077673100000000000000000000000000f401088070000080"], 0x21c}}, 0x0) 349.307354ms ago: executing program 1 (id=1489): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000011c0)={0xc, 0x0, 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000540)={@local, @multicast, @void, {@ipv4={0x800, @generic={{0x7, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x35}, {[@cipso={0x86, 0x6}]}}}}}}, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(r2, 0x400445a0, &(0x7f0000000040)=""/255) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r3 = add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280)="d25a9850a9d77f", 0x7, 0xfffffffffffffffe) r4 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, r4, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r5 = add_key$user(&(0x7f0000000080), &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0)="3621177d33f46a45c4e990aeb237162912621f299ddc07c23401f2199ec0859d4045fc83978c1bd2bb49f0be", 0x2c, 0xffffffffffffffff) syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100003afe0620e60405000001010203010902240001000010000904140002a024260009050602ff030000000905820208"], 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000200)={r3, r5}, &(0x7f00000002c0)=""/66, 0x42, &(0x7f0000000400)={&(0x7f0000000240)={'blake2b-160\x00'}, &(0x7f0000000340)="869a0f70dc3342b2f03aa77db311f58f999ae85ad5b2316eb321b3a034118813b7c7905138bbe696cf76fa99e509682883c03dfa9ccef267ed18e3ed45322ec93966900378c35b3a66bd5426df829db070997f7c14244541b7dfcd7308d6d6767aaed7d892e54ba6fd3e82d2e7dfd3b8423d6759f5ad74f8b0384a24daab71998ca7915f2b5db6f9010625bd66bb3a29b28b38f747a935f74415b5761628c90766751531", 0xa4}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f00000000c0)={0x48, r1, 0x1, 0x0, &(0x7f0000000280)=[{0x7fff, 0x7fffffff}]}) 0s ago: executing program 3 (id=1490): syz_usb_control_io$printer(0xffffffffffffffff, &(0x7f0000000280)={0x14, &(0x7f00000000c0)={0x20, 0x22, 0x7c, {0x7c, 0xf, "3fd15af9c1ce48b447e0d6b76c92a7a0e9cb7f0ab2129bcf0d9c5731186978da96f2114cff15ed859506b9619f90e4aef5e60d1ef077336eb808876d4009a564a29da83723fa9eaf9fe653386d2be3275999f665ac417716239db9f1cc149461412dae21a26ead68b7bdedbd459eb7a3fce8c77e2d7234b21b1b"}}, &(0x7f0000000200)={0x0, 0x3, 0x65, @string={0x65, 0x3, "816635e55b0239d2bf00c4f1d4198fe9cf45d1c01702f72afc290a8b2c65a99f45c9f7caa0e7dd26b141c34c225c85f3fd515fc3d6409edc7e99494f8f17223620ed7d4e9e0fb78f2fab713463c0c669f8db1aa89aa055786a6ae39f39e8dbd137272f"}}}, &(0x7f0000000500)={0x34, 0x0, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x7}, 0x0, &(0x7f0000000400)={0x20, 0x0, 0xb, {0x9, "0db71e3c3d87a45895"}}, &(0x7f0000000480)={0x20, 0x1, 0x1, 0x8}, &(0x7f00000004c0)={0x20, 0x0, 0x1, 0xa2}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x4e3, &(0x7f0000000380)={0x0, 0x33f8, 0x10100, 0x0, 0x0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) msgget$private(0x0, 0x5a4) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) r5 = socket$qrtr(0x2a, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME_WAIT_CANCEL(r6, 0x0, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000680), 0xc, &(0x7f00000006c0)={&(0x7f0000000740)=ANY=[@ANYRES16=r7, @ANYBLOB="020026bd7000fedbdf25440000000c00990006000000190000000f002400608602090bc809b60b02b0000c002380080017000600000008002600501400000500180130000000080026006c0900000800a1000800000008002400c86036040a001800030303030303000008006b000b000000"], 0x78}}, 0x4000000) readlinkat(0xffffffffffffffff, &(0x7f0000000800)='./file0/../file0\x00', &(0x7f0000000840)=""/149, 0x95) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000340)={0x3, 0x9}, 0x4) io_uring_enter(r2, 0x708, 0x41e3, 0x0, 0x0, 0x0) r8 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r8, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r8, 0x0) r9 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r9, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r10 = accept4(r8, 0x0, 0x0, 0x0) recvfrom$inet(r10, &(0x7f0000000540)=""/234, 0xea, 0x40000182, 0x0, 0x0) ioctl$SIOCGSTAMP(r8, 0x8906, &(0x7f00000002c0)) r11 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='fdinfo\x00') getdents64(r11, &(0x7f0000000240)=""/32, 0x20) getdents64(r11, 0x0, 0xffffffff00000018) r12 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) pread64(r12, &(0x7f0000000180)=""/79, 0xfffffe69, 0x1) kernel console output (not intermixed with test programs): [ 409.653154][ T5909] usb 5-1: Using ep0 maxpacket: 16 [ 409.670297][ T44] gspca_sonixj: reg_w err -71 [ 409.675409][ T44] sonixj 1-1:0.0: probe with driver sonixj failed with error -71 [ 409.715588][ T5909] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 409.743088][ T44] usb 1-1: USB disconnect, device number 49 [ 409.751211][ T5909] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 409.791819][ T5909] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 409.829366][ T5909] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 409.852729][ T5909] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 409.872717][ T860] dvb-usb: bulk message failed: -22 (1/0) [ 409.878721][ T860] dvb-usb: error while querying for an remote control event. [ 409.897021][ T5909] usb 5-1: config 0 descriptor?? [ 410.052142][ T860] dvb-usb: bulk message failed: -22 (1/0) [ 410.068184][ T860] dvb-usb: error while querying for an remote control event. [ 410.295986][ T860] dvb-usb: bulk message failed: -22 (1/0) [ 410.315894][ T860] dvb-usb: error while querying for an remote control event. [ 410.346377][ T9979] wg1: entered promiscuous mode [ 410.355993][ T9979] wg1: entered allmulticast mode [ 410.547810][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 410.558946][ T5929] dvb-usb: error while querying for an remote control event. [ 410.732490][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 410.740913][ T5929] dvb-usb: error while querying for an remote control event. [ 411.012273][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 411.019691][ T5929] dvb-usb: error while querying for an remote control event. [ 411.196917][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 411.204439][ T5929] dvb-usb: error while querying for an remote control event. [ 411.332281][ T5929] usb 4-1: USB disconnect, device number 55 [ 411.372005][ T860] dvb-usb: bulk message failed: -22 (1/0) [ 411.378086][ T860] dvb-usb: error while querying for an remote control event. [ 411.543699][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 411.555831][ T5929] dvb-usb: error while querying for an remote control event. [ 411.772409][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 411.778466][ T5929] dvb-usb: error while querying for an remote control event. [ 411.942876][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 411.949203][ T5929] dvb-usb: error while querying for an remote control event. [ 412.036959][ T5916] usb 2-1: USB disconnect, device number 63 [ 412.077496][T10007] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1153'. [ 412.079002][ T5916] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 412.223298][T10009] FAULT_INJECTION: forcing a failure. [ 412.223298][T10009] name failslab, interval 1, probability 0, space 0, times 0 [ 412.301242][T10009] CPU: 0 UID: 0 PID: 10009 Comm: syz.1.1154 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 412.301275][T10009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 412.301288][T10009] Call Trace: [ 412.301296][T10009] [ 412.301305][T10009] dump_stack_lvl+0x189/0x250 [ 412.301335][T10009] ? __pfx____ratelimit+0x10/0x10 [ 412.301367][T10009] ? __pfx_dump_stack_lvl+0x10/0x10 [ 412.301392][T10009] ? __pfx__printk+0x10/0x10 [ 412.301422][T10009] ? __pfx___might_resched+0x10/0x10 [ 412.301447][T10009] ? fs_reclaim_acquire+0x7d/0x100 [ 412.301481][T10009] should_fail_ex+0x414/0x560 [ 412.301516][T10009] should_failslab+0xa8/0x100 [ 412.301546][T10009] kmem_cache_alloc_noprof+0x73/0x3c0 [ 412.301571][T10009] ? getname_flags+0xb8/0x540 [ 412.301605][T10009] getname_flags+0xb8/0x540 [ 412.301638][T10009] __x64_sys_mkdir+0x5d/0x80 [ 412.301663][T10009] do_syscall_64+0xfa/0x3b0 [ 412.301682][T10009] ? lockdep_hardirqs_on+0x9c/0x150 [ 412.301714][T10009] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.301735][T10009] ? clear_bhb_loop+0x60/0xb0 [ 412.301760][T10009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.301780][T10009] RIP: 0033:0x7f929418e929 [ 412.301798][T10009] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 412.301816][T10009] RSP: 002b:00007f9294f71038 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 412.301837][T10009] RAX: ffffffffffffffda RBX: 00007f92943b5fa0 RCX: 00007f929418e929 [ 412.301852][T10009] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 412.301871][T10009] RBP: 00007f9294f71090 R08: 0000000000000000 R09: 0000000000000000 [ 412.301887][T10009] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 412.301898][T10009] R13: 0000000000000000 R14: 00007f92943b5fa0 R15: 00007f92944dfa28 [ 412.301927][T10009] [ 412.829794][ T5909] usbhid 5-1:0.0: can't add hid device: -71 [ 412.852059][ T5909] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 412.883335][ T5909] usb 5-1: USB disconnect, device number 67 [ 413.432116][ T5909] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 413.582117][ T5909] usb 5-1: device descriptor read/64, error -71 [ 413.762313][T10044] CIFS: VFS: Malformed UNC in devname [ 413.770216][T10044] netlink: 272 bytes leftover after parsing attributes in process `syz.3.1166'. [ 413.842465][ T5909] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 414.021997][ T5909] usb 5-1: device descriptor read/64, error -71 [ 414.132662][ T5909] usb usb5-port1: attempt power cycle [ 414.142357][ T860] usb 3-1: new full-speed USB device number 70 using dummy_hcd [ 414.462181][ T860] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 414.502076][ T860] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 414.582818][ T5909] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 414.619793][ T860] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 414.646823][ T860] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.677492][ T5909] usb 5-1: device descriptor read/8, error -71 [ 414.712311][ T5933] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 414.726958][ T860] usb 3-1: config 0 descriptor?? [ 414.748045][ T860] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 414.777163][ T860] dvb-usb: bulk message failed: -22 (3/0) [ 414.910933][ T860] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 414.940505][ T5933] usb 2-1: New USB device found, idVendor=6189, idProduct=182d, bcdDevice= 1.73 [ 414.960256][ T5933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.968750][ T5933] usb 2-1: Product: syz [ 414.983563][ T860] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 414.992535][ T5933] usb 2-1: Manufacturer: syz [ 414.997374][ T5933] usb 2-1: SerialNumber: syz [ 415.002571][ T860] usb 3-1: media controller created [ 415.020204][ T860] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 415.032242][ T5909] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 415.050562][ T5933] usb 2-1: config 0 descriptor?? [ 415.066669][ T5909] usb 5-1: device descriptor read/8, error -71 [ 415.080217][T10045] dibusb: i2c wr: len=61 is too big! [ 415.080217][T10045] [ 415.091608][ T860] dvb-usb: bulk message failed: -22 (6/0) [ 415.099013][ T860] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 415.167197][ T860] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input41 [ 415.214068][ T860] dvb-usb: schedule remote query interval to 150 msecs. [ 415.222076][ T5929] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 415.232681][ T5909] usb usb5-port1: unable to enumerate USB device [ 415.249631][ T860] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 415.401986][ T860] dvb-usb: bulk message failed: -22 (1/0) [ 415.419735][ T860] dvb-usb: error while querying for an remote control event. [ 415.594203][ T860] dvb-usb: bulk message failed: -22 (1/0) [ 415.604677][ T860] dvb-usb: error while querying for an remote control event. [ 415.864315][ T860] dvb-usb: bulk message failed: -22 (1/0) [ 415.918831][ T860] dvb-usb: error while querying for an remote control event. [ 416.108638][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 416.118458][ T9] dvb-usb: error while querying for an remote control event. [ 416.210171][ T5933] asix 2-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 416.302501][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 416.310573][ T5929] dvb-usb: error while querying for an remote control event. [ 416.372568][T10056] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1170'. [ 416.495953][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 416.506762][ T9] dvb-usb: error while querying for an remote control event. [ 416.711758][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 416.720848][ T9] dvb-usb: error while querying for an remote control event. [ 416.842060][ T44] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 416.952570][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 416.958565][ T9] dvb-usb: error while querying for an remote control event. [ 417.024383][ T44] usb 5-1: Using ep0 maxpacket: 16 [ 417.032104][ T44] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 417.040582][ T44] usb 5-1: config 0 has no interface number 0 [ 417.050362][ T44] usb 5-1: New USB device found, idVendor=06e1, idProduct=0709, bcdDevice= 2.04 [ 417.060612][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.081623][ T44] usb 5-1: Product: syz [ 417.090766][ T44] usb 5-1: Manufacturer: syz [ 417.096111][ T44] usb 5-1: SerialNumber: syz [ 417.113837][ T44] usb 5-1: config 0 descriptor?? [ 417.262276][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 417.309989][ T9] dvb-usb: error while querying for an remote control event. [ 417.512261][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 417.518407][ T9] dvb-usb: error while querying for an remote control event. [ 417.692256][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 417.698250][ T9] dvb-usb: error while querying for an remote control event. [ 417.818262][ T5916] usb 3-1: USB disconnect, device number 70 [ 417.906957][ T5916] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 418.359532][ T5933] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 418.442011][ T5933] asix 2-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 418.496060][ T5933] asix 2-1:0.0: probe with driver asix failed with error -71 [ 418.557034][ T5933] usb 2-1: USB disconnect, device number 64 [ 419.040174][T10092] netlink: 'syz.3.1182': attribute type 1 has an invalid length. [ 419.049331][T10092] netlink: 168864 bytes leftover after parsing attributes in process `syz.3.1182'. [ 419.571850][ T44] go7007 5-1:0.41: probe with driver go7007 failed with error -12 [ 419.577400][T10101] fuse: Bad value for 'rootmode' [ 419.614277][ T44] usb 5-1: USB disconnect, device number 72 [ 419.652149][ T5181] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 419.812066][ T5181] usb 1-1: Using ep0 maxpacket: 8 [ 419.832152][ T5181] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 419.851590][ T5181] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 419.906760][ T5181] usb 1-1: New USB device found, idVendor=16d0, idProduct=10a9, bcdDevice=30.52 [ 419.917478][ T5181] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 419.948653][ T5181] usb 1-1: Product: syz [ 419.971549][ T5181] usb 1-1: Manufacturer: syz [ 419.987611][ T5181] usb 1-1: SerialNumber: syz [ 420.015054][ T5181] usb 1-1: config 0 descriptor?? [ 420.122066][ T5933] usb 2-1: new full-speed USB device number 65 using dummy_hcd [ 420.238924][T10111] openvswitch: netlink: IP tunnel TTL not specified. [ 420.303454][ T5181] usb 1-1: USB disconnect, device number 51 [ 420.313781][ T5933] usb 2-1: config 1 interface 0 has no altsetting 0 [ 420.326121][ T5933] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 420.337046][ T5933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.369575][ T5933] usb 2-1: Product: syz [ 420.396156][ T5933] usb 2-1: Manufacturer: syz [ 420.415839][ T5933] usb 2-1: SerialNumber: syz [ 420.897723][ T5933] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 65 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 420.952102][ T5181] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 421.123747][ T5181] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 421.145507][ T5181] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 421.244818][ T5181] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 421.268545][ T5181] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.297922][ T5181] usb 4-1: config 0 descriptor?? [ 421.472823][ T44] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 421.567991][ T5916] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 421.586018][ T5181] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 421.597781][ T5181] dvb-usb: bulk message failed: -22 (3/0) [ 421.640103][ T44] usb 1-1: device descriptor read/64, error -71 [ 421.651204][ T5181] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 421.672347][ T5181] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 421.693609][ T5181] usb 4-1: media controller created [ 421.800904][T10117] dibusb: i2c wr: len=61 is too big! [ 421.800904][T10117] [ 421.825973][ T5916] usb 5-1: Using ep0 maxpacket: 16 [ 421.956035][ T5181] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 421.965765][ T5916] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 421.976404][ T5916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 421.988029][ T44] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 422.006437][ T5181] dvb-usb: bulk message failed: -22 (6/0) [ 422.015204][ T5916] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 422.035646][ T5181] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 422.049244][ T5916] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 422.069325][ T5181] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input42 [ 422.100268][ T5916] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 422.121170][ T5181] dvb-usb: schedule remote query interval to 150 msecs. [ 422.132014][ T44] usb 1-1: device descriptor read/64, error -71 [ 422.157450][ T5181] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 422.179813][ T5916] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 422.233842][ T5916] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 422.260209][ T5916] usb 5-1: Manufacturer: syz [ 422.267329][ T44] usb usb1-port1: attempt power cycle [ 422.284255][ T5916] usb 5-1: config 0 descriptor?? [ 422.312116][ T5181] dvb-usb: bulk message failed: -22 (1/0) [ 422.318004][ T5181] dvb-usb: error while querying for an remote control event. [ 422.482095][ T5181] dvb-usb: bulk message failed: -22 (1/0) [ 422.488439][ T5181] dvb-usb: error while querying for an remote control event. [ 422.652456][ T44] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 422.673363][ T5181] dvb-usb: bulk message failed: -22 (1/0) [ 422.681524][ T5181] dvb-usb: error while querying for an remote control event. [ 422.692405][ T44] usb 1-1: device descriptor read/8, error -71 [ 422.782177][ T5916] rc_core: IR keymap rc-hauppauge not found [ 422.803722][ T5916] Registered IR keymap rc-empty [ 422.842447][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 422.853521][ T5181] dvb-usb: bulk message failed: -22 (1/0) [ 422.874359][ T5181] dvb-usb: error while querying for an remote control event. [ 422.892248][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 422.914517][ T5916] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 422.932241][ T44] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 422.943262][ T5916] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input43 [ 422.957500][ T44] usb 1-1: device descriptor read/8, error -71 [ 422.988341][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.016682][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.042494][ T5181] dvb-usb: bulk message failed: -22 (1/0) [ 423.048565][ T5181] dvb-usb: error while querying for an remote control event. [ 423.060602][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.072822][ T44] usb usb1-port1: unable to enumerate USB device [ 423.112191][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.145494][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.222078][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 423.227998][ T44] dvb-usb: error while querying for an remote control event. [ 423.244637][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.302226][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.355577][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.402457][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.442158][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 423.448076][ T44] dvb-usb: error while querying for an remote control event. [ 423.484921][ T5916] mceusb 5-1:0.0: Error: mce write submit urb error = -90 [ 423.549344][ T5916] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 423.600668][ T5916] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 423.622262][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 423.628182][ T44] dvb-usb: error while querying for an remote control event. [ 423.822250][ T5916] dvb-usb: bulk message failed: -22 (1/0) [ 423.837685][ T5916] dvb-usb: error while querying for an remote control event. [ 424.047032][ T30] kauditd_printk_skb: 39 callbacks suppressed [ 424.047052][ T30] audit: type=1326 audit(1751649569.456:1262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10133 comm="syz.2.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fc238e929 code=0x7ffc0000 [ 424.101761][ T5916] dvb-usb: bulk message failed: -22 (1/0) [ 424.128258][T10134] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1197'. [ 424.172101][ T5916] dvb-usb: error while querying for an remote control event. [ 424.225895][ T30] audit: type=1326 audit(1751649569.456:1263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10133 comm="syz.2.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fc238e929 code=0x7ffc0000 [ 424.386391][ T30] audit: type=1326 audit(1751649569.516:1264): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10133 comm="syz.2.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f4fc238e929 code=0x7ffc0000 [ 424.387842][ T5916] usb 2-1: USB disconnect, device number 65 [ 424.442335][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 424.460871][ T44] dvb-usb: error while querying for an remote control event. [ 424.477877][ T5181] usb 4-1: USB disconnect, device number 56 [ 424.544418][ T30] audit: type=1326 audit(1751649569.516:1265): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10133 comm="syz.2.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fc238e929 code=0x7ffc0000 [ 424.623032][ T5916] usblp0: removed [ 424.669004][ T5181] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 424.677589][ T30] audit: type=1326 audit(1751649569.516:1266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10133 comm="syz.2.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fc238e929 code=0x7ffc0000 [ 424.677641][ T30] audit: type=1326 audit(1751649569.536:1267): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10133 comm="syz.2.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f4fc238e929 code=0x7ffc0000 [ 424.677685][ T30] audit: type=1326 audit(1751649569.656:1268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10133 comm="syz.2.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fc238e929 code=0x7ffc0000 [ 424.828645][T10146] netlink: 'syz.3.1201': attribute type 10 has an invalid length. [ 424.837983][T10146] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1201'. [ 424.861530][ T44] usb 5-1: USB disconnect, device number 73 [ 424.931680][T10146] team0: Port device geneve0 added [ 424.962344][ T30] audit: type=1326 audit(1751649569.656:1269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10133 comm="syz.2.1197" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4fc238e929 code=0x7ffc0000 [ 425.310219][T10164] FAULT_INJECTION: forcing a failure. [ 425.310219][T10164] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 425.331749][T10164] CPU: 1 UID: 0 PID: 10164 Comm: syz.2.1209 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 425.331775][T10164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 425.331785][T10164] Call Trace: [ 425.331792][T10164] [ 425.331799][T10164] dump_stack_lvl+0x189/0x250 [ 425.331825][T10164] ? __pfx____ratelimit+0x10/0x10 [ 425.331851][T10164] ? __pfx_dump_stack_lvl+0x10/0x10 [ 425.331881][T10164] ? __pfx__printk+0x10/0x10 [ 425.331908][T10164] ? __might_fault+0xb0/0x130 [ 425.331943][T10164] should_fail_ex+0x414/0x560 [ 425.331986][T10164] _copy_from_user+0x2d/0xb0 [ 425.332010][T10164] rds_get_mr+0xdf/0x170 [ 425.332042][T10164] ? __pfx_rds_get_mr+0x10/0x10 [ 425.332071][T10164] ? rcu_read_lock_any_held+0xb3/0x120 [ 425.332092][T10164] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 425.332116][T10164] rds_setsockopt+0x1a4/0xc40 [ 425.332142][T10164] ? __pfx_rds_setsockopt+0x10/0x10 [ 425.332162][T10164] ? aa_sk_perm+0x81e/0x950 [ 425.332184][T10164] ? vfs_write+0x8d8/0xa90 [ 425.332205][T10164] ? __pfx_aa_sk_perm+0x10/0x10 [ 425.332229][T10164] ? __pfx_vfs_write+0x10/0x10 [ 425.332249][T10164] ? aa_sock_opt_perm+0x74/0x110 [ 425.332275][T10164] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 425.332289][T10164] ? __pfx_rds_setsockopt+0x10/0x10 [ 425.332312][T10164] do_sock_setsockopt+0x25a/0x3e0 [ 425.332337][T10164] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 425.332360][T10164] ? ksys_write+0x1e1/0x250 [ 425.332386][T10164] __x64_sys_setsockopt+0x18b/0x220 [ 425.332411][T10164] do_syscall_64+0xfa/0x3b0 [ 425.332426][T10164] ? lockdep_hardirqs_on+0x9c/0x150 [ 425.332452][T10164] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.332467][T10164] ? clear_bhb_loop+0x60/0xb0 [ 425.332487][T10164] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 425.332502][T10164] RIP: 0033:0x7f4fc238e929 [ 425.332518][T10164] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 425.332532][T10164] RSP: 002b:00007f4fc329f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 425.332550][T10164] RAX: ffffffffffffffda RBX: 00007f4fc25b5fa0 RCX: 00007f4fc238e929 [ 425.332561][T10164] RDX: 0000000000000002 RSI: 0000000000000114 RDI: 0000000000000003 [ 425.332571][T10164] RBP: 00007f4fc329f090 R08: 0000000000000020 R09: 0000000000000000 [ 425.332581][T10164] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001 [ 425.332591][T10164] R13: 0000000000000000 R14: 00007f4fc25b5fa0 R15: 00007f4fc26dfa28 [ 425.332615][T10164] [ 426.106867][T10174] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 426.262263][ T5933] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 426.322018][ T9] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 426.440342][ T5933] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 426.455332][ T5933] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 426.471958][ T5933] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 426.481335][ T5933] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 426.502353][ T860] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 426.556114][ T9] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 426.565043][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 426.578970][ T5933] usb 4-1: config 0 descriptor?? [ 426.587366][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 426.618180][ T9] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 426.631051][ T5933] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 426.639680][ T5933] dvb-usb: bulk message failed: -22 (3/0) [ 426.650856][ T5933] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 426.663604][ T9] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 426.672861][ T9] usb 3-1: Manufacturer: syz [ 426.678164][ T5933] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 426.692651][ T9] usb 3-1: config 0 descriptor?? [ 426.700348][ T5933] usb 4-1: media controller created [ 426.709433][ T9] igorplugusb 3-1:0.0: incorrect number of endpoints [ 426.744942][T10183] netlink: 'syz.4.1215': attribute type 21 has an invalid length. [ 426.757323][ T860] usb 2-1: Using ep0 maxpacket: 8 [ 426.763893][ T5933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 426.776821][ T860] usb 2-1: config 0 has an invalid interface number: 52 but max is 0 [ 426.786430][ T860] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 426.800247][ T860] usb 2-1: config 0 has no interface number 0 [ 426.819450][ T860] usb 2-1: config 0 interface 52 has no altsetting 0 [ 426.826796][ T5933] dvb-usb: bulk message failed: -22 (6/0) [ 426.836841][ T5933] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 426.847613][ T860] usb 2-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 426.857577][ T860] usb 2-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 426.879578][ T860] usb 2-1: Manufacturer: syz [ 426.890610][ T5933] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input44 [ 426.930587][T10171] dibusb: i2c wr: len=61 is too big! [ 426.930587][T10171] [ 426.935711][ T860] usb 2-1: config 0 descriptor?? [ 426.945697][ T5933] dvb-usb: schedule remote query interval to 150 msecs. [ 426.982433][ T5933] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 427.142966][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 427.153161][ T5933] dvb-usb: error while querying for an remote control event. [ 427.197910][ T860] usb 2-1: Can not set alternate setting to 1, error: -71 [ 427.206002][ T860] synaptics_usb 2-1:0.52: probe with driver synaptics_usb failed with error -71 [ 427.228752][ T860] usb 2-1: USB disconnect, device number 66 [ 427.314729][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 427.329146][ T5929] dvb-usb: error while querying for an remote control event. [ 427.552129][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 427.558076][ T5929] dvb-usb: error while querying for an remote control event. [ 427.742022][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 427.747928][ T5929] dvb-usb: error while querying for an remote control event. [ 428.004712][T10191] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1217'. [ 428.081986][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 428.091181][ T5929] dvb-usb: error while querying for an remote control event. [ 428.332172][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 428.339339][ T5929] dvb-usb: error while querying for an remote control event. [ 428.532634][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 428.539095][ T5929] dvb-usb: error while querying for an remote control event. [ 428.712323][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 428.720816][ T5933] dvb-usb: error while querying for an remote control event. [ 428.875990][ T5929] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 428.922278][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 428.928218][ T5181] usb 4-1: USB disconnect, device number 57 [ 428.930346][ T5933] dvb-usb: error while querying for an remote control event. [ 429.011106][ T5181] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 429.081562][ T5929] usb 1-1: Using ep0 maxpacket: 16 [ 429.143730][ T5929] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 429.158561][ T5929] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 429.175418][ T5916] usb 3-1: USB disconnect, device number 71 [ 429.211012][ T5929] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 429.241666][ T5929] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 429.255490][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.276803][ T5929] usb 1-1: Product: syz [ 429.281104][ T5929] usb 1-1: Manufacturer: syz [ 429.287041][ T5929] usb 1-1: SerialNumber: syz [ 429.362401][ T5933] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 429.433189][ T5181] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 429.639557][ T30] audit: type=1800 audit(1751649575.046:1270): pid=10205 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1223" name="SYSV00000000" dev="tmpfs" ino=1 res=0 errno=0 [ 429.652233][ T5181] usb 4-1: Using ep0 maxpacket: 32 [ 429.706554][ T5933] usb 2-1: config 0 has no interfaces? [ 429.736583][ T5933] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 429.736643][ T5933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.736666][ T5933] usb 2-1: Product: syz [ 429.736682][ T5933] usb 2-1: Manufacturer: syz [ 429.736698][ T5933] usb 2-1: SerialNumber: syz [ 429.745377][ T5181] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 429.745410][ T5181] usb 4-1: config 0 has no interface number 0 [ 429.749182][ T5181] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 429.749219][ T5181] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.749241][ T5181] usb 4-1: Product: syz [ 429.749257][ T5181] usb 4-1: Manufacturer: syz [ 429.749273][ T5181] usb 4-1: SerialNumber: syz [ 429.765781][ T5181] usb 4-1: config 0 descriptor?? [ 429.767879][ T5933] usb 2-1: config 0 descriptor?? [ 429.771439][ T5181] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 429.902070][ T5916] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 430.062600][ T5916] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 430.062665][ T5916] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 430.062690][ T5916] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 430.062736][ T5916] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 430.062761][ T5916] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.084881][ T5916] usb 3-1: config 0 descriptor?? [ 430.184592][T10211] veth1_macvtap: left promiscuous mode [ 430.527415][T10211] veth1_macvtap: entered promiscuous mode [ 430.617343][ T5181] usb 4-1: qt2_attach - failed to power on unit: -71 [ 430.659273][T10205] tty tty2: ldisc open failed (-12), clearing slot 1 [ 430.771707][ T5916] usbhid 3-1:0.0: can't add hid device: -71 [ 430.780694][ T5916] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 430.874045][T10224] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 430.974022][ T5916] usb 3-1: USB disconnect, device number 72 [ 430.995404][ T5181] quatech2 4-1:0.51: probe with driver quatech2 failed with error -71 [ 431.192134][ T5933] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 431.218997][ T5181] usb 4-1: USB disconnect, device number 58 [ 431.366109][ T5933] usb 5-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 431.382569][T10231] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1229'. [ 431.440377][ T5933] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 431.490681][ T5929] usb 1-1: 0:2 : does not exist [ 431.512978][ T5933] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 431.527324][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.581394][ T5933] usb 5-1: Product: syz [ 431.617059][ T5929] usb 1-1: USB disconnect, device number 56 [ 431.626957][ T5933] usb 5-1: Manufacturer: syz [ 431.702954][ T5933] usb 5-1: SerialNumber: syz [ 431.709420][ T59] veth1_macvtap: left promiscuous mode [ 431.764951][ T5933] hub 5-1:1.0: bad descriptor, ignoring hub [ 431.811782][ T8556] udevd[8556]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 431.853382][ T5933] hub 5-1:1.0: probe with driver hub failed with error -5 [ 432.019161][ T5933] usb 5-1: USB disconnect, device number 74 [ 432.033933][T10236] dummy0: entered promiscuous mode [ 432.080083][T10236] dummy0: left promiscuous mode [ 432.127111][T10238] FAULT_INJECTION: forcing a failure. [ 432.127111][T10238] name failslab, interval 1, probability 0, space 0, times 0 [ 432.158117][T10238] CPU: 1 UID: 0 PID: 10238 Comm: syz.3.1232 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 432.158150][T10238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 432.158164][T10238] Call Trace: [ 432.158172][T10238] [ 432.158181][T10238] dump_stack_lvl+0x189/0x250 [ 432.158212][T10238] ? __pfx____ratelimit+0x10/0x10 [ 432.158244][T10238] ? __pfx_dump_stack_lvl+0x10/0x10 [ 432.158269][T10238] ? __pfx__printk+0x10/0x10 [ 432.158298][T10238] ? __pfx___might_resched+0x10/0x10 [ 432.158322][T10238] ? fs_reclaim_acquire+0x7d/0x100 [ 432.158358][T10238] should_fail_ex+0x414/0x560 [ 432.158395][T10238] should_failslab+0xa8/0x100 [ 432.158425][T10238] __kmalloc_noprof+0xcb/0x4f0 [ 432.158454][T10238] ? __list_lru_init+0xba/0x5c0 [ 432.158491][T10238] __list_lru_init+0xba/0x5c0 [ 432.158530][T10238] alloc_super+0x819/0x970 [ 432.158556][T10238] ? __pfx_fuse_test_super+0x10/0x10 [ 432.158578][T10238] sget_fc+0x329/0xa40 [ 432.158602][T10238] ? __pfx_fuse_set_no_super+0x10/0x10 [ 432.158624][T10238] fuse_get_tree+0x40b/0x4e0 [ 432.158655][T10238] vfs_get_tree+0x92/0x2b0 [ 432.158685][T10238] do_new_mount+0x24a/0xa40 [ 432.158722][T10238] __se_sys_mount+0x317/0x410 [ 432.158758][T10238] ? __pfx___se_sys_mount+0x10/0x10 [ 432.158784][T10238] ? rcu_is_watching+0x15/0xb0 [ 432.158815][T10238] ? do_syscall_64+0xbe/0x3b0 [ 432.158833][T10238] ? __x64_sys_mount+0x20/0xc0 [ 432.158864][T10238] do_syscall_64+0xfa/0x3b0 [ 432.158883][T10238] ? lockdep_hardirqs_on+0x9c/0x150 [ 432.158914][T10238] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.158934][T10238] ? clear_bhb_loop+0x60/0xb0 [ 432.158959][T10238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.158978][T10238] RIP: 0033:0x7f6826f8e929 [ 432.158996][T10238] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 432.159014][T10238] RSP: 002b:00007f6827e89038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 432.159036][T10238] RAX: ffffffffffffffda RBX: 00007f68271b5fa0 RCX: 00007f6826f8e929 [ 432.159052][T10238] RDX: 00002000000001c0 RSI: 00002000000020c0 RDI: 0000000000000000 [ 432.159066][T10238] RBP: 00007f6827e89090 R08: 0000200000000240 R09: 0000000000000000 [ 432.159080][T10238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 432.159092][T10238] R13: 0000000000000000 R14: 00007f68271b5fa0 R15: 00007f68272dfa28 [ 432.159125][T10238] [ 432.486000][ T5929] usb 2-1: USB disconnect, device number 67 [ 432.852353][ T5933] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 432.992247][ T5933] usb 5-1: device descriptor read/64, error -71 [ 433.262019][ T5933] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 433.271981][ T5181] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 433.302174][ T5916] usb 3-1: new full-speed USB device number 73 using dummy_hcd [ 433.393177][ T5933] usb 5-1: device descriptor read/64, error -71 [ 433.426659][ T5181] usb 1-1: config 0 has no interfaces? [ 433.435453][ T5181] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 433.447501][ T5181] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.512714][ T5933] usb usb5-port1: attempt power cycle [ 433.529468][ T5916] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.701382][ T5181] usb 1-1: Product: syz [ 433.760937][ T5916] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 433.783553][ T5181] usb 1-1: Manufacturer: syz [ 433.819072][ T5181] usb 1-1: SerialNumber: syz [ 433.829602][ T5916] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 433.859814][ T5181] usb 1-1: config 0 descriptor?? [ 433.869164][ T5916] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.882169][ T5933] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 433.982321][ T9] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 434.005696][ T5916] usb 3-1: config 0 descriptor?? [ 434.078859][ T5916] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 434.102081][ T5933] usb 5-1: device not accepting address 77, error -71 [ 434.145159][ T9] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 434.160933][ T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 434.178255][ T9] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 434.190414][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 434.190468][ T5916] dvb-usb: bulk message failed: -22 (3/0) [ 434.218037][ T9] usb 4-1: SerialNumber: syz [ 434.280895][ T5916] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 434.310079][ T5916] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 434.426381][ T5916] usb 3-1: media controller created [ 434.446086][ T5916] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 434.476445][ T5916] dvb-usb: bulk message failed: -22 (6/0) [ 434.526720][ T5916] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 434.550002][T10257] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1237'. [ 434.580386][ T5916] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input45 [ 434.637705][ T5916] dvb-usb: schedule remote query interval to 150 msecs. [ 434.643961][ T9] usb 4-1: 0:2 : does not exist [ 434.782462][ T5916] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 434.917914][ T9] usb 4-1: USB disconnect, device number 59 [ 434.941997][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 434.948090][ T24] dvb-usb: error while querying for an remote control event. [ 435.095191][ T8556] udevd[8556]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 435.133204][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 435.150198][ T24] dvb-usb: error while querying for an remote control event. [ 435.332890][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 435.346954][ T24] dvb-usb: error while querying for an remote control event. [ 435.512877][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 435.518747][ T24] dvb-usb: error while querying for an remote control event. [ 435.662083][ T5916] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 435.682016][ T5181] dvb-usb: bulk message failed: -22 (1/0) [ 435.687870][ T5181] dvb-usb: error while querying for an remote control event. [ 435.822296][ T5916] usb 2-1: Using ep0 maxpacket: 16 [ 435.833998][ T5916] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 435.852004][ T5181] dvb-usb: bulk message failed: -22 (1/0) [ 435.859238][ T5181] dvb-usb: error while querying for an remote control event. [ 435.878473][ T5916] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 435.938131][ T9] usb 1-1: USB disconnect, device number 57 [ 435.940524][ T5916] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 435.954695][ T5916] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 435.976103][ T5916] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 435.995195][ T5916] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 436.005817][ T5916] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 436.015675][ T5916] usb 2-1: Manufacturer: syz [ 436.022448][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 436.029586][ T24] dvb-usb: error while querying for an remote control event. [ 436.057665][ T5916] usb 2-1: config 0 descriptor?? [ 436.192193][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 436.199049][ T24] dvb-usb: error while querying for an remote control event. [ 436.276207][T10268] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.285322][T10268] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.443844][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 436.449641][ T24] dvb-usb: error while querying for an remote control event. [ 436.545862][ T5929] usb 3-1: USB disconnect, device number 73 [ 436.652564][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 436.658472][ T24] dvb-usb: error while querying for an remote control event. [ 436.725219][ T5929] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 436.742053][ T5916] rc_core: IR keymap rc-hauppauge not found [ 436.788692][ T5916] Registered IR keymap rc-empty [ 436.812020][ T9] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 436.812271][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 436.909540][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 436.967978][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 437.079109][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 437.089467][ T5916] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 437.150246][ T9] usb 1-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.00 [ 437.170867][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.173165][ T5916] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input46 [ 437.233032][ T9] usb 1-1: config 0 descriptor?? [ 437.278423][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.342261][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.382076][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.432265][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.472418][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.492497][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.522239][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.593341][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.642617][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.672320][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.702607][ T5916] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 437.742898][ T5916] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 437.754177][ T5916] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 437.784123][ T5916] usb 2-1: USB disconnect, device number 68 [ 437.870233][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 437.876746][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 437.901624][ T9] usb 1-1: USB disconnect, device number 58 [ 437.957196][ T24] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 438.054678][T10302] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1252'. [ 438.144259][ T24] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 438.203065][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 438.222555][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 438.235731][T10304] _ÐZ`Ô€@ÿÃ: entered promiscuous mode [ 438.242227][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 438.288003][ T24] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 438.305980][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.328481][ T24] usb 4-1: config 0 descriptor?? [ 438.556816][T10300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.580022][T10300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.782313][ T9] usb 1-1: new full-speed USB device number 59 using dummy_hcd [ 438.819624][ T24] plantronics 0003:047F:FFFF.000D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 438.932264][ T5929] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 438.946030][ T9] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 438.955452][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.964005][ T9] usb 1-1: Product: syz [ 438.968422][ T9] usb 1-1: Manufacturer: syz [ 438.973368][ T9] usb 1-1: SerialNumber: syz [ 438.980528][ T9] usb 1-1: config 0 descriptor?? [ 439.070441][T10331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.083521][T10300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.084035][T10331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.099408][ T24] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 439.103170][ T5929] usb 2-1: config 1 interface 0 has no altsetting 0 [ 439.118149][ T5929] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 439.129437][T10300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.143146][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.151261][ T5929] usb 2-1: Product: syz [ 439.172126][ T5929] usb 2-1: Manufacturer: syz [ 439.176853][ T5929] usb 2-1: SerialNumber: syz [ 439.192060][ T9] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 439.230011][ T10] usb 4-1: USB disconnect, device number 60 [ 439.267728][ T9] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 439.274319][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 439.295369][ T24] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 439.316927][ T9] usb 1-1: USB disconnect, device number 59 [ 439.326881][ T24] usb 3-1: config 0 has no interfaces? [ 439.365260][ T24] usb 3-1: New USB device found, idVendor=0ed0, idProduct=10b8, bcdDevice=de.8e [ 439.415321][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.446231][ T24] usb 3-1: Product: syz [ 439.472350][ T24] usb 3-1: Manufacturer: syz [ 439.485944][ T24] usb 3-1: SerialNumber: syz [ 439.513382][ T24] usb 3-1: config 0 descriptor?? [ 439.643974][ T5929] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 69 if 0 alt 253 proto 1 vid 0x0525 pid 0xA4A8 [ 439.818094][T10329] netlink: 136 bytes leftover after parsing attributes in process `syz.2.1263'. [ 439.835452][T10329] A link change request failed with some changes committed already. Interface ip6gretap0 may have been left with an inconsistent configuration, please check. [ 439.929094][ T5181] usb 3-1: USB disconnect, device number 74 [ 441.328740][T10367] xt_recent: Unsupported userspace flags (000000de) [ 441.786497][ T24] usb 2-1: USB disconnect, device number 69 [ 441.808257][ T24] usblp0: removed [ 442.042063][ T5181] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 442.211984][ T5181] usb 4-1: Using ep0 maxpacket: 8 [ 442.219127][ T5181] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 442.239063][ T5181] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 442.282901][ T30] audit: type=1326 audit(1751649587.696:1271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10392 comm="syz.2.1282" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4fc238e929 code=0x0 [ 442.395073][ T5181] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 442.420114][ T5181] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 442.531774][ T5181] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 442.616239][ T5181] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 442.710866][ T5181] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.997000][ T5181] usb 4-1: GET_CAPABILITIES returned 0 [ 443.011552][ T5181] usbtmc 4-1:16.0: can't read capabilities [ 443.221563][ T5181] usb 4-1: USB disconnect, device number 61 [ 443.494351][T10403] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 443.598425][T10403] netlink: 'syz.2.1284': attribute type 3 has an invalid length. [ 443.652209][T10403] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1284'. [ 444.126240][T10413] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1287'. [ 444.333261][T10417] fuse: Unknown parameter 'n' [ 445.475331][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 445.481829][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 446.229893][T10451] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 446.372019][ T5181] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 446.547424][ T5181] usb 5-1: Using ep0 maxpacket: 32 [ 446.684103][ T5181] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 446.692676][ T5181] usb 5-1: config 0 has no interface number 0 [ 446.710746][ T5181] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 446.720026][ T5181] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.728168][ T5181] usb 5-1: Product: syz [ 446.732454][ T5181] usb 5-1: Manufacturer: syz [ 446.737128][ T5181] usb 5-1: SerialNumber: syz [ 446.767984][ T5181] usb 5-1: config 0 descriptor?? [ 446.811640][ T5181] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 446.952367][ T10] usb 4-1: new full-speed USB device number 62 using dummy_hcd [ 447.124700][ T10] usb 4-1: config 0 has an invalid interface number: 20 but max is 0 [ 447.179513][ T10] usb 4-1: config 0 has no interface number 0 [ 447.269141][ T10] usb 4-1: config 0 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 447.444730][ T10] usb 4-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 447.480788][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.516295][ T10] usb 4-1: Product: syz [ 447.538100][ T10] usb 4-1: Manufacturer: syz [ 447.559096][ T10] usb 4-1: SerialNumber: syz [ 447.598780][ T10] usb 4-1: config 0 descriptor?? [ 447.642943][T10451] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 447.675128][ T10] ums-sddr09 4-1:0.20: USB Mass Storage device detected [ 448.201161][ T10] ums-sddr09 4-1:0.20: probe with driver ums-sddr09 failed with error -22 [ 448.241534][T10479] FAULT_INJECTION: forcing a failure. [ 448.241534][T10479] name failslab, interval 1, probability 0, space 0, times 0 [ 448.295610][T10479] CPU: 0 UID: 0 PID: 10479 Comm: syz.0.1304 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 448.295642][T10479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 448.295656][T10479] Call Trace: [ 448.295665][T10479] [ 448.295676][T10479] dump_stack_lvl+0x189/0x250 [ 448.295708][T10479] ? __pfx____ratelimit+0x10/0x10 [ 448.295741][T10479] ? __pfx_dump_stack_lvl+0x10/0x10 [ 448.295766][T10479] ? __pfx__printk+0x10/0x10 [ 448.295799][T10479] ? __pfx___might_resched+0x10/0x10 [ 448.295824][T10479] ? fs_reclaim_acquire+0x7d/0x100 [ 448.295861][T10479] should_fail_ex+0x414/0x560 [ 448.295899][T10479] should_failslab+0xa8/0x100 [ 448.295929][T10479] __kmalloc_noprof+0xcb/0x4f0 [ 448.295954][T10479] ? tomoyo_encode+0x28b/0x550 [ 448.295989][T10479] tomoyo_encode+0x28b/0x550 [ 448.296017][T10479] tomoyo_realpath_from_path+0x58d/0x5d0 [ 448.296051][T10479] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 448.296079][T10479] tomoyo_path_number_perm+0x1e8/0x5a0 [ 448.296110][T10479] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 448.296159][T10479] ? __lock_acquire+0xab9/0xd20 [ 448.296204][T10479] ? __fget_files+0x2a/0x420 [ 448.296236][T10479] ? __fget_files+0x2a/0x420 [ 448.296264][T10479] ? __fget_files+0x3a0/0x420 [ 448.296291][T10479] ? __fget_files+0x2a/0x420 [ 448.296325][T10479] security_file_ioctl+0xcb/0x2d0 [ 448.296356][T10479] __se_sys_ioctl+0x47/0x170 [ 448.296382][T10479] do_syscall_64+0xfa/0x3b0 [ 448.296404][T10479] ? lockdep_hardirqs_on+0x9c/0x150 [ 448.296436][T10479] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.296458][T10479] ? clear_bhb_loop+0x60/0xb0 [ 448.296483][T10479] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.296504][T10479] RIP: 0033:0x7fdef1d8e929 [ 448.296523][T10479] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 448.296540][T10479] RSP: 002b:00007fdeefbf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 448.296563][T10479] RAX: ffffffffffffffda RBX: 00007fdef1fb5fa0 RCX: 00007fdef1d8e929 [ 448.296579][T10479] RDX: 00002000000008c0 RSI: 0000000040087543 RDI: 0000000000000006 [ 448.296593][T10479] RBP: 00007fdeefbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 448.296606][T10479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 448.296619][T10479] R13: 0000000000000000 R14: 00007fdef1fb5fa0 R15: 00007fdef20dfa28 [ 448.296652][T10479] [ 448.296880][T10479] ERROR: Out of memory at tomoyo_realpath_from_path. [ 448.557300][ T5929] usb 3-1: new full-speed USB device number 75 using dummy_hcd [ 448.639943][ T10] usb 4-1: USB disconnect, device number 62 [ 448.814796][ T5929] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 448.852316][ T5929] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 448.906706][ T5929] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 448.966483][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.033819][ T5929] usb 3-1: config 0 descriptor?? [ 449.058230][ T5929] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 449.068132][ T5929] dvb-usb: bulk message failed: -22 (3/0) [ 449.091485][ T5929] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 449.322642][T10475] dibusb: i2c wr: len=61 is too big! [ 449.322642][T10475] [ 449.454781][ T5929] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 449.485775][ T5929] usb 3-1: media controller created [ 449.515977][ T5929] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 449.807238][ T5929] dvb-usb: bulk message failed: -22 (6/0) [ 449.899855][ T5929] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 450.203911][ T5929] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input48 [ 450.351453][ T5929] dvb-usb: schedule remote query interval to 150 msecs. [ 450.545405][ T5933] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 450.606846][ T5929] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 450.720873][ T5933] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 450.765047][ T5933] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 450.778524][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 450.800923][ T5929] dvb-usb: error while querying for an remote control event. [ 450.840571][ T5933] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 450.861157][ T5933] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 450.891421][ T5933] usb 4-1: Manufacturer: syz [ 450.916166][ T5933] usb 4-1: config 0 descriptor?? [ 450.945551][ T5933] igorplugusb 4-1:0.0: incorrect number of endpoints [ 450.963565][ T5181] usb 5-1: qt2_attach - failed to power on unit: -71 [ 450.997976][ T5181] quatech2 5-1:0.51: probe with driver quatech2 failed with error -71 [ 451.002146][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 451.048510][ T5929] dvb-usb: error while querying for an remote control event. [ 451.068811][ T5181] usb 5-1: USB disconnect, device number 79 [ 451.222089][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 451.249313][ T5933] dvb-usb: error while querying for an remote control event. [ 451.432104][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 451.453949][ T5933] dvb-usb: error while querying for an remote control event. [ 451.508713][ T5181] usb 3-1: USB disconnect, device number 75 [ 451.605048][ T5181] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 452.207256][T10541] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 452.252035][ T5916] usb 2-1: new full-speed USB device number 70 using dummy_hcd [ 452.404249][ T5916] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 452.415944][ T5916] usb 2-1: New USB device found, idVendor=056e, idProduct=00e6, bcdDevice= 0.00 [ 452.426196][ T5916] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.440157][ T5916] usb 2-1: config 0 descriptor?? [ 452.472199][ T5933] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 452.632271][ T5933] usb 5-1: Using ep0 maxpacket: 16 [ 452.643103][ T5933] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 452.654858][ T5933] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 452.665375][ T5933] usb 5-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 452.668743][T10537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 452.675928][ T5933] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.692590][T10537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 452.715848][ T5933] usb 5-1: config 0 descriptor?? [ 452.739422][T10537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 452.751594][T10537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 452.771583][T10537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 452.787411][ T30] audit: type=1326 audit(1751649598.196:1272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10536 comm="syz.1.1322" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f929418e929 code=0x7fc00000 [ 452.789943][T10537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 452.817753][ C0] vkms_vblank_simulate: vblank timer overrun [ 452.940604][ T5916] usbhid 2-1:0.0: can't add hid device: -71 [ 452.981209][ T5916] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 453.062375][ T5916] usb 2-1: USB disconnect, device number 70 [ 453.148353][ T5933] gt683r_led 0003:1770:FF00.000E: unbalanced delimiter at end of report description [ 453.530224][ T5933] gt683r_led 0003:1770:FF00.000E: hid parsing failed [ 453.584792][ T5933] gt683r_led 0003:1770:FF00.000E: probe with driver gt683r_led failed with error -22 [ 453.597883][ T5181] usb 4-1: USB disconnect, device number 63 [ 453.751279][ T5909] usb 5-1: USB disconnect, device number 80 [ 453.757672][ T5916] usb 2-1: new full-speed USB device number 71 using dummy_hcd [ 453.812179][ T860] usb 3-1: new full-speed USB device number 76 using dummy_hcd [ 453.930718][ T5916] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 453.945020][ T5916] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 453.955696][ T5916] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 453.968855][ T5916] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.985501][ T5916] usb 2-1: config 0 descriptor?? [ 453.994828][ T860] usb 3-1: config 0 has an invalid interface number: 231 but max is 1 [ 454.005440][ T860] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 454.151246][ T5916] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 454.167762][ T5916] dvb-usb: bulk message failed: -22 (3/0) [ 454.302576][ T860] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 454.319060][ T860] usb 3-1: config 0 has no interface number 0 [ 454.327209][ T5916] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 454.332052][ T860] usb 3-1: too many endpoints for config 0 interface 231 altsetting 88: 199, using maximum allowed: 30 [ 454.354247][ T860] usb 3-1: config 0 interface 231 altsetting 88 has 0 endpoint descriptors, different from the interface descriptor's value: 199 [ 454.377590][ T5916] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 454.387187][ T860] usb 3-1: config 0 interface 231 has no altsetting 0 [ 454.387639][ T5916] usb 2-1: media controller created [ 454.401145][ T860] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 454.425364][ T860] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.461404][ T5916] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 454.486792][ T860] usb 3-1: config 0 descriptor?? [ 454.504489][ T5916] dvb-usb: bulk message failed: -22 (6/0) [ 454.511152][ T5916] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 454.641990][ T5916] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input49 [ 454.703064][ T5916] dvb-usb: schedule remote query interval to 150 msecs. [ 454.958106][ T5916] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 455.112368][ T5916] dvb-usb: bulk message failed: -22 (1/0) [ 455.118440][ T5916] dvb-usb: error while querying for an remote control event. [ 455.282352][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 455.288360][ T5909] dvb-usb: error while querying for an remote control event. [ 455.452380][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 455.458481][ T5909] dvb-usb: error while querying for an remote control event. [ 455.579909][T10585] fuse: Bad value for 'fd' [ 455.622238][ T5916] dvb-usb: bulk message failed: -22 (1/0) [ 455.633996][ T5916] dvb-usb: error while querying for an remote control event. [ 455.898447][ T5916] dvb-usb: bulk message failed: -22 (1/0) [ 455.908573][ T5916] dvb-usb: error while querying for an remote control event. [ 456.039797][T10594] FAULT_INJECTION: forcing a failure. [ 456.039797][T10594] name failslab, interval 1, probability 0, space 0, times 0 [ 456.052994][T10594] CPU: 1 UID: 0 PID: 10594 Comm: syz.0.1337 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 456.053022][T10594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 456.053035][T10594] Call Trace: [ 456.053043][T10594] [ 456.053049][T10594] dump_stack_lvl+0x189/0x250 [ 456.053073][T10594] ? __pfx____ratelimit+0x10/0x10 [ 456.053100][T10594] ? __pfx_dump_stack_lvl+0x10/0x10 [ 456.053126][T10594] ? __pfx__printk+0x10/0x10 [ 456.053166][T10594] should_fail_ex+0x414/0x560 [ 456.053198][T10594] should_failslab+0xa8/0x100 [ 456.053220][T10594] __kmalloc_noprof+0xcb/0x4f0 [ 456.053239][T10594] ? nsim_fib_event_nb+0x295/0x1080 [ 456.053278][T10594] nsim_fib_event_nb+0x295/0x1080 [ 456.053319][T10594] notifier_call_chain+0x1b3/0x3e0 [ 456.053344][T10594] ? atomic_notifier_call_chain+0x26/0x180 [ 456.053371][T10594] atomic_notifier_call_chain+0xda/0x180 [ 456.053391][T10594] call_fib_notifiers+0x31/0x60 [ 456.053419][T10594] fib6_add_rt2node+0x15fb/0x33a0 [ 456.053465][T10594] ? rcu_is_watching+0x15/0xb0 [ 456.053492][T10594] ? __pfx_fib6_add_rt2node+0x10/0x10 [ 456.053512][T10594] ? fib6_add_1+0x1029/0x1460 [ 456.053543][T10594] fib6_add+0x8da/0x18a0 [ 456.053580][T10594] ? do_raw_spin_lock+0x121/0x290 [ 456.053608][T10594] ? __pfx_fib6_add+0x10/0x10 [ 456.053639][T10594] ? ip6_route_add+0xc9/0x1b0 [ 456.053661][T10594] ip6_route_add+0xde/0x1b0 [ 456.053682][T10594] inet6_addr_add+0x6b2/0xc00 [ 456.053714][T10594] ? __pfx_inet6_addr_add+0x10/0x10 [ 456.053771][T10594] addrconf_add_ifaddr+0x27d/0x400 [ 456.053797][T10594] ? __pfx_addrconf_add_ifaddr+0x10/0x10 [ 456.053824][T10594] inet6_ioctl+0x13d/0x280 [ 456.053840][T10594] ? __pfx_inet6_ioctl+0x10/0x10 [ 456.053861][T10594] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 456.053890][T10594] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 456.053916][T10594] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 456.053941][T10594] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 456.053970][T10594] sock_do_ioctl+0xd9/0x300 [ 456.054000][T10594] ? __pfx_sock_do_ioctl+0x10/0x10 [ 456.054029][T10594] ? __lock_acquire+0xab9/0xd20 [ 456.054065][T10594] sock_ioctl+0x576/0x790 [ 456.054097][T10594] ? __pfx_sock_ioctl+0x10/0x10 [ 456.054125][T10594] ? __fget_files+0x2a/0x420 [ 456.054151][T10594] ? __fget_files+0x3a0/0x420 [ 456.054177][T10594] ? __fget_files+0x2a/0x420 [ 456.054208][T10594] ? bpf_lsm_file_ioctl+0x9/0x20 [ 456.054229][T10594] ? __pfx_sock_ioctl+0x10/0x10 [ 456.054258][T10594] __se_sys_ioctl+0xf9/0x170 [ 456.054284][T10594] do_syscall_64+0xfa/0x3b0 [ 456.054305][T10594] ? lockdep_hardirqs_on+0x9c/0x150 [ 456.054337][T10594] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.054365][T10594] ? clear_bhb_loop+0x60/0xb0 [ 456.054389][T10594] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.054409][T10594] RIP: 0033:0x7fdef1d8e929 [ 456.054428][T10594] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 456.054447][T10594] RSP: 002b:00007fdeefbf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 456.054469][T10594] RAX: ffffffffffffffda RBX: 00007fdef1fb5fa0 RCX: 00007fdef1d8e929 [ 456.054485][T10594] RDX: 00002000000020c0 RSI: 0000000000008916 RDI: 0000000000000003 [ 456.054499][T10594] RBP: 00007fdeefbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 456.054511][T10594] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 456.054523][T10594] R13: 0000000000000000 R14: 00007fdef1fb5fa0 R15: 00007fdef20dfa28 [ 456.054551][T10594] [ 456.401188][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 456.407035][ T5909] dvb-usb: error while querying for an remote control event. [ 456.467204][T10596] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1336'. [ 456.609547][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 456.615478][ T5909] dvb-usb: error while querying for an remote control event. [ 456.677019][ T860] usb 3-1: string descriptor 0 read error: -71 [ 456.718273][ T860] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 456.782149][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 456.787978][ T5909] dvb-usb: error while querying for an remote control event. [ 456.870741][ T860] dvb-usb: bulk message failed: -22 (3/0) [ 456.882862][ T860] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 456.935998][ T860] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 456.956748][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 456.992190][ T860] usb 3-1: media controller created [ 457.014136][ T860] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 457.034495][T10609] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1340'. [ 457.062402][ T5909] dvb-usb: error while querying for an remote control event. [ 457.124428][ T5909] usb 2-1: USB disconnect, device number 71 [ 457.213385][ T860] dvb-usb: bulk message failed: -22 (6/0) [ 457.252943][ T860] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 457.445312][ T860] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input50 [ 457.523616][ T5909] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 457.843251][ T860] dvb-usb: schedule remote query interval to 150 msecs. [ 457.870716][ T860] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 457.908244][ T860] usb 3-1: USB disconnect, device number 76 [ 458.371981][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 458.391023][ T5933] dvb-usb: error while querying for an remote control event. [ 458.666477][ T860] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 458.922845][T10637] FAULT_INJECTION: forcing a failure. [ 458.922845][T10637] name failslab, interval 1, probability 0, space 0, times 0 [ 458.945466][T10637] CPU: 0 UID: 0 PID: 10637 Comm: syz.1.1344 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 458.945500][T10637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 458.945514][T10637] Call Trace: [ 458.945523][T10637] [ 458.945533][T10637] dump_stack_lvl+0x189/0x250 [ 458.945564][T10637] ? __pfx____ratelimit+0x10/0x10 [ 458.945598][T10637] ? __pfx_dump_stack_lvl+0x10/0x10 [ 458.945624][T10637] ? __pfx__printk+0x10/0x10 [ 458.945660][T10637] ? __pfx___might_resched+0x10/0x10 [ 458.945691][T10637] should_fail_ex+0x414/0x560 [ 458.945728][T10637] should_failslab+0xa8/0x100 [ 458.945759][T10637] __kmalloc_cache_noprof+0x70/0x3d0 [ 458.945786][T10637] ? snd_seq_port_connect+0x6b/0x430 [ 458.945820][T10637] snd_seq_port_connect+0x6b/0x430 [ 458.945849][T10637] ? do_raw_read_unlock+0x3d/0x80 [ 458.945879][T10637] ? _raw_read_unlock+0x28/0x50 [ 458.945916][T10637] snd_seq_ioctl_subscribe_port+0x339/0x710 [ 458.945956][T10637] ? __pfx_snd_seq_ioctl_subscribe_port+0x10/0x10 [ 458.946008][T10637] snd_seq_oss_midi_open+0x4b9/0x7b0 [ 458.946039][T10637] ? __pfx_snd_seq_oss_midi_open+0x10/0x10 [ 458.946084][T10637] snd_seq_oss_synth_reset+0x3c4/0x880 [ 458.946113][T10637] ? __pfx_snd_seq_oss_synth_reset+0x10/0x10 [ 458.946134][T10637] ? __pfx___mutex_trylock_common+0x10/0x10 [ 458.946159][T10637] ? __x64_sys_openat+0x138/0x170 [ 458.946177][T10637] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.946201][T10637] ? rcu_is_watching+0x15/0xb0 [ 458.946230][T10637] snd_seq_oss_reset+0x5a/0x240 [ 458.946265][T10637] snd_seq_oss_release+0xeb/0x2e0 [ 458.946297][T10637] ? __pfx_snd_seq_oss_release+0x10/0x10 [ 458.946333][T10637] ? __asan_memset+0x22/0x50 [ 458.946355][T10637] ? odev_release+0x4b/0x70 [ 458.946388][T10637] ? __pfx___mutex_lock+0x10/0x10 [ 458.946410][T10637] ? __pfx___fsnotify_parent+0x10/0x10 [ 458.946435][T10637] ? do_raw_spin_lock+0x121/0x290 [ 458.946478][T10637] ? evm_file_release+0x108/0x1e0 [ 458.946500][T10637] ? __pfx_odev_release+0x10/0x10 [ 458.946530][T10637] odev_release+0x53/0x70 [ 458.946558][T10637] __fput+0x449/0xa70 [ 458.946591][T10637] task_work_run+0x1d1/0x260 [ 458.946628][T10637] ? __pfx_task_work_run+0x10/0x10 [ 458.946667][T10637] ? exit_to_user_mode_loop+0x40/0x110 [ 458.946694][T10637] exit_to_user_mode_loop+0xec/0x110 [ 458.946718][T10637] do_syscall_64+0x2bd/0x3b0 [ 458.946738][T10637] ? lockdep_hardirqs_on+0x9c/0x150 [ 458.946770][T10637] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.946792][T10637] ? clear_bhb_loop+0x60/0xb0 [ 458.946817][T10637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.946839][T10637] RIP: 0033:0x7f929418e929 [ 458.946858][T10637] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 458.946877][T10637] RSP: 002b:00007f9294f71038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 458.946899][T10637] RAX: ffffffffffffffea RBX: 00007f92943b5fa0 RCX: 00007f929418e929 [ 458.946915][T10637] RDX: 000000000008417f RSI: 0000200000000140 RDI: ffffffffffffff9c [ 458.946930][T10637] RBP: 00007f9294f71090 R08: 0000000000000000 R09: 0000000000000000 [ 458.946945][T10637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 458.946958][T10637] R13: 0000000000000000 R14: 00007f92943b5fa0 R15: 00007f92944dfa28 [ 458.946992][T10637] [ 460.226324][T10646] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 460.295441][T10650] syz_tun: entered allmulticast mode [ 460.305329][T10649] syz_tun: left allmulticast mode [ 460.482073][ T5909] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 460.673767][ T5909] usb 2-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 460.711814][ T5909] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 460.757133][ T5909] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 460.770253][ T5909] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.877363][ T5909] usb 2-1: Product: syz [ 460.881583][ T5909] usb 2-1: Manufacturer: syz [ 460.895199][ T5909] usb 2-1: SerialNumber: syz [ 460.971794][T10664] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1353'. [ 460.972628][ T5909] hub 2-1:1.0: bad descriptor, ignoring hub [ 461.030619][ T30] audit: type=1326 audit(1751649606.436:1273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10665 comm="syz.3.1354" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6826f8e929 code=0x0 [ 461.069142][ T5909] hub 2-1:1.0: probe with driver hub failed with error -5 [ 461.082007][ T5929] usb 5-1: new full-speed USB device number 81 using dummy_hcd [ 461.264569][ T5929] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 461.275129][ T5929] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 461.289567][ T5929] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 461.299676][ T5929] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.317226][ T5929] usb 5-1: config 0 descriptor?? [ 461.329906][ T5933] usb 2-1: USB disconnect, device number 72 [ 461.373341][ T5929] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 461.380381][ T5929] dvb-usb: bulk message failed: -22 (3/0) [ 461.394814][ T5929] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 461.412663][ T5929] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 461.423524][ T5929] usb 5-1: media controller created [ 461.437113][ T5929] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 461.518717][ T5929] dvb-usb: bulk message failed: -22 (6/0) [ 461.555223][ T5929] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 461.575918][T10662] dibusb: i2c wr: len=61 is too big! [ 461.575918][T10662] [ 461.634119][ T5929] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input51 [ 461.676524][ T5929] dvb-usb: schedule remote query interval to 150 msecs. [ 461.836996][ T5929] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 461.902007][ T5916] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 462.004182][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 462.032775][ T5916] usb 2-1: device descriptor read/64, error -71 [ 462.037114][ T5929] dvb-usb: error while querying for an remote control event. [ 462.223383][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 462.229382][ T5929] dvb-usb: error while querying for an remote control event. [ 462.319307][ T5916] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 462.352241][ T24] usb 3-1: new high-speed USB device number 77 using dummy_hcd [ 462.402187][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 462.415043][ T5929] dvb-usb: error while querying for an remote control event. [ 462.542261][ T5916] usb 2-1: device descriptor read/64, error -71 [ 462.584698][ T24] usb 3-1: config 0 has no interfaces? [ 462.594407][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 462.607830][ T5933] dvb-usb: error while querying for an remote control event. [ 462.640254][ T24] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 462.667024][ T5916] usb usb2-port1: attempt power cycle [ 462.680129][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.747226][ T24] usb 3-1: Product: syz [ 462.769735][ T24] usb 3-1: Manufacturer: syz [ 462.791975][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 462.794073][ T24] usb 3-1: SerialNumber: syz [ 462.822072][ T5933] dvb-usb: error while querying for an remote control event. [ 462.839563][ T24] usb 3-1: config 0 descriptor?? [ 463.075136][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 463.090175][ T5933] dvb-usb: error while querying for an remote control event. [ 463.122911][T10681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 463.136992][T10681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 463.299182][ T860] dvb-usb: bulk message failed: -22 (1/0) [ 463.305254][ T860] dvb-usb: error while querying for an remote control event. [ 463.328697][ T5916] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 463.395683][ T5916] usb 2-1: device descriptor read/8, error -71 [ 463.562276][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 463.572578][ T5933] dvb-usb: error while querying for an remote control event. [ 463.834356][ T860] usb 5-1: USB disconnect, device number 81 [ 463.968720][ T860] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 464.246053][ T30] audit: type=1326 audit(1751649609.656:1274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10713 comm="syz.1.1368" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f929418e929 code=0x0 [ 465.396460][ T5181] usb 3-1: USB disconnect, device number 77 [ 465.922002][ T5181] usb 3-1: new low-speed USB device number 78 using dummy_hcd [ 466.075143][ T5933] usb 4-1: new full-speed USB device number 64 using dummy_hcd [ 466.101273][ T5181] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 466.109651][ T5181] usb 3-1: can't read configurations, error -22 [ 466.242107][ T5181] usb 3-1: new low-speed USB device number 79 using dummy_hcd [ 466.407542][ T5181] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 466.417857][ T5181] usb 3-1: can't read configurations, error -22 [ 466.425103][ T5181] usb usb3-port1: attempt power cycle [ 466.464547][ T5933] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 466.520519][ T5933] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 466.533612][ T5933] usb 4-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 466.560751][ T5933] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.605220][ T5933] usb 4-1: config 0 descriptor?? [ 466.743967][ T5933] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 466.750664][ T5933] dvb-usb: bulk message failed: -22 (3/0) [ 466.801999][ T5181] usb 3-1: new low-speed USB device number 80 using dummy_hcd [ 466.828119][ T30] audit: type=1326 audit(1751649612.206:1275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10766 comm="syz.4.1382" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fca94f8e929 code=0x0 [ 466.868621][ T5181] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 466.877914][ T5181] usb 3-1: can't read configurations, error -22 [ 466.947562][ T5933] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 467.012326][ T5181] usb 3-1: new low-speed USB device number 81 using dummy_hcd [ 467.046163][ T5181] usb 3-1: config index 0 descriptor too short (expected 9, got 0) [ 467.054480][ T5181] usb 3-1: can't read configurations, error -22 [ 467.068828][ T5181] usb usb3-port1: unable to enumerate USB device [ 467.111136][ T5933] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 467.138738][ T5933] usb 4-1: media controller created [ 467.164789][ T5933] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 467.368365][ T5933] dvb-usb: bulk message failed: -22 (6/0) [ 467.384410][ T5933] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 467.430734][ T5933] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input52 [ 467.474325][ T5933] dvb-usb: schedule remote query interval to 150 msecs. [ 467.500672][ T5933] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 467.661566][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 467.724090][ T5933] dvb-usb: error while querying for an remote control event. [ 467.912010][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 467.949577][ T5933] dvb-usb: error while querying for an remote control event. [ 468.263945][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 468.269769][ T5933] dvb-usb: error while querying for an remote control event. [ 468.329566][T10778] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 468.536672][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 468.549743][ T5933] dvb-usb: error while querying for an remote control event. [ 468.591985][ T24] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 468.752203][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 468.810287][ T5929] dvb-usb: error while querying for an remote control event. [ 468.913127][ T24] usb 1-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 468.951674][ T24] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 468.986664][ T24] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 469.002115][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 469.009014][ T5929] dvb-usb: error while querying for an remote control event. [ 469.108855][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.175351][ T5929] usb 4-1: USB disconnect, device number 64 [ 469.220196][ T24] usb 1-1: Product: syz [ 469.240842][ T24] usb 1-1: Manufacturer: syz [ 469.260117][ T24] usb 1-1: SerialNumber: syz [ 469.319716][ T5929] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 469.324459][ T24] hub 1-1:1.0: bad descriptor, ignoring hub [ 469.370555][ T24] hub 1-1:1.0: probe with driver hub failed with error -5 [ 469.797002][ T5929] usb 1-1: USB disconnect, device number 60 [ 470.112248][ T5929] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 470.252847][ T5929] usb 1-1: device descriptor read/64, error -71 [ 470.495315][ T5929] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 470.644739][ T5929] usb 1-1: device descriptor read/64, error -71 [ 470.769357][T10820] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1395'. [ 470.870773][ T5929] usb usb1-port1: attempt power cycle [ 471.022063][ T5933] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 471.152916][ T860] usb 3-1: new full-speed USB device number 82 using dummy_hcd [ 471.242498][ T5933] usb 2-1: Using ep0 maxpacket: 8 [ 471.250545][ T5933] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 471.265756][ T5933] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 471.323919][ T860] usb 3-1: New USB device found, idVendor=0830, idProduct=0080, bcdDevice=d5.70 [ 471.335124][ T860] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.392259][ T5909] usb 5-1: new full-speed USB device number 82 using dummy_hcd [ 471.417292][ T5933] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 471.466246][ T860] usb 3-1: Product: syz [ 471.471787][ T5933] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 471.484755][ T860] usb 3-1: Manufacturer: syz [ 471.510801][ T860] usb 3-1: SerialNumber: syz [ 471.526855][ T5933] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 471.702160][ T5909] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 471.725326][ T5909] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 471.734561][ T5181] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 471.746860][ T5909] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 471.758268][ T5909] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.767367][ T5933] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 471.776140][ T5909] usb 5-1: config 0 descriptor?? [ 471.792635][ T5933] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.799906][ T860] kl5kusb105 3-1:110.0: KL5KUSB105D / PalmConnect converter detected [ 471.800058][ T5909] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 471.863472][ T5909] dvb-usb: bulk message failed: -22 (3/0) [ 471.882157][ T5181] usb 4-1: device descriptor read/64, error -71 [ 471.897150][ T5909] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 471.907669][ T5909] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 471.915523][ T860] usb 3-1: KL5KUSB105D / PalmConnect converter now attached to ttyUSB0 [ 471.923549][ T5909] usb 5-1: media controller created [ 471.936250][ T5909] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 472.003296][T10827] dibusb: i2c wr: len=61 is too big! [ 472.003296][T10827] [ 472.138399][ T5181] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 472.157033][ T5909] dvb-usb: bulk message failed: -22 (6/0) [ 472.189737][ T5909] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 472.202653][ T5909] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input53 [ 472.209141][ T5933] usb 2-1: usb_control_msg returned -32 [ 472.278340][ T5181] usb 4-1: device descriptor read/64, error -71 [ 472.295036][ T5909] dvb-usb: schedule remote query interval to 150 msecs. [ 472.302027][ T5933] usbtmc 2-1:16.0: can't read capabilities [ 472.311344][ T5909] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 472.345608][ T5933] usb 2-1: USB disconnect, device number 77 [ 472.402292][ T5181] usb usb4-port1: attempt power cycle [ 472.462518][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 472.469501][ T5909] dvb-usb: error while querying for an remote control event. [ 472.642400][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 472.649536][ T5909] dvb-usb: error while querying for an remote control event. [ 472.754060][ T5181] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 472.790324][ T5181] usb 4-1: device descriptor read/8, error -71 [ 472.852476][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 472.859344][ T44] dvb-usb: error while querying for an remote control event. [ 473.032892][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 473.084324][ T44] dvb-usb: error while querying for an remote control event. [ 473.092433][ T5181] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 473.135101][ T5181] usb 4-1: device descriptor read/8, error -71 [ 473.160947][T10844] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 473.257696][ T5181] usb usb4-port1: unable to enumerate USB device [ 473.268984][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 473.275744][ T24] dvb-usb: error while querying for an remote control event. [ 473.442095][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 473.448355][ T24] dvb-usb: error while querying for an remote control event. [ 473.642545][ T5181] dvb-usb: bulk message failed: -22 (1/0) [ 473.648369][ T5181] dvb-usb: error while querying for an remote control event. [ 473.744763][T10853] FAULT_INJECTION: forcing a failure. [ 473.744763][T10853] name failslab, interval 1, probability 0, space 0, times 0 [ 473.758590][T10853] CPU: 1 UID: 0 PID: 10853 Comm: syz.0.1410 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 473.758621][T10853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 473.758635][T10853] Call Trace: [ 473.758645][T10853] [ 473.758654][T10853] dump_stack_lvl+0x189/0x250 [ 473.758678][T10853] ? __pfx____ratelimit+0x10/0x10 [ 473.758703][T10853] ? __pfx_dump_stack_lvl+0x10/0x10 [ 473.758721][T10853] ? __pfx__printk+0x10/0x10 [ 473.758744][T10853] ? __pfx___might_resched+0x10/0x10 [ 473.758762][T10853] ? fs_reclaim_acquire+0x7d/0x100 [ 473.758788][T10853] should_fail_ex+0x414/0x560 [ 473.758815][T10853] should_failslab+0xa8/0x100 [ 473.758838][T10853] __kmalloc_node_track_caller_noprof+0xcc/0x4e0 [ 473.758859][T10853] ? __kernfs_new_node+0x9c/0x7e0 [ 473.758890][T10853] kstrdup+0x42/0x100 [ 473.758914][T10853] __kernfs_new_node+0x9c/0x7e0 [ 473.758944][T10853] ? __pfx___kernfs_new_node+0x10/0x10 [ 473.758965][T10853] ? kernfs_root+0x1c/0x230 [ 473.758991][T10853] ? kernfs_root+0x1c/0x230 [ 473.759011][T10853] ? kernfs_root+0x1c/0x230 [ 473.759036][T10853] kernfs_new_node+0x102/0x210 [ 473.759063][T10853] kernfs_create_link+0xa7/0x200 [ 473.759083][T10853] sysfs_do_create_link_sd+0x83/0x110 [ 473.759112][T10853] device_add_class_symlinks+0x1cf/0x240 [ 473.759135][T10853] device_add+0x475/0xb50 [ 473.759158][T10853] input_register_device+0x9ca/0x10b0 [ 473.759185][T10853] uinput_create_device+0x422/0x670 [ 473.759199][T10853] ? __lock_acquire+0xab9/0xd20 [ 473.759219][T10853] uinput_ioctl_handler+0x3f0/0x1570 [ 473.759236][T10853] ? __pfx_uinput_ioctl_handler+0x10/0x10 [ 473.759259][T10853] ? __fget_files+0x2a/0x420 [ 473.759279][T10853] ? __fget_files+0x3a0/0x420 [ 473.759303][T10853] ? bpf_lsm_file_ioctl+0x9/0x20 [ 473.759321][T10853] ? __pfx_uinput_ioctl+0x10/0x10 [ 473.759334][T10853] __se_sys_ioctl+0xf9/0x170 [ 473.759353][T10853] do_syscall_64+0xfa/0x3b0 [ 473.759367][T10853] ? lockdep_hardirqs_on+0x9c/0x150 [ 473.759390][T10853] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.759404][T10853] ? clear_bhb_loop+0x60/0xb0 [ 473.759422][T10853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.759437][T10853] RIP: 0033:0x7fdef1d8e929 [ 473.759451][T10853] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 473.759464][T10853] RSP: 002b:00007fdeefbf6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 473.759480][T10853] RAX: ffffffffffffffda RBX: 00007fdef1fb5fa0 RCX: 00007fdef1d8e929 [ 473.759491][T10853] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 [ 473.759500][T10853] RBP: 00007fdeefbf6090 R08: 0000000000000000 R09: 0000000000000000 [ 473.759509][T10853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 473.759517][T10853] R13: 0000000000000000 R14: 00007fdef1fb5fa0 R15: 00007fdef20dfa28 [ 473.759540][T10853] [ 474.061542][ T5181] dvb-usb: bulk message failed: -22 (1/0) [ 474.067605][ T5181] dvb-usb: error while querying for an remote control event. [ 474.128032][T10855] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1411'. [ 474.228216][ T5933] usb 5-1: USB disconnect, device number 82 [ 474.234734][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 474.240538][ T44] dvb-usb: error while querying for an remote control event. [ 474.300514][ T44] usb 3-1: USB disconnect, device number 82 [ 474.311304][ T44] kl5kusb105d ttyUSB0: KL5KUSB105D / PalmConnect converter now disconnected from ttyUSB0 [ 474.327680][ T44] kl5kusb105 3-1:110.0: device disconnected [ 474.409933][ T5933] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 475.022344][ T5181] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 475.182345][ T5181] usb 2-1: Using ep0 maxpacket: 32 [ 475.201601][ T5181] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 475.209930][ T5181] usb 2-1: config 0 has no interface number 0 [ 475.252600][ T5181] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 475.269683][ T5181] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.282070][ T5181] usb 2-1: Product: syz [ 475.286295][ T5181] usb 2-1: Manufacturer: syz [ 475.301214][ T5181] usb 2-1: SerialNumber: syz [ 475.852618][ T5181] usb 2-1: config 0 descriptor?? [ 475.883495][ T5181] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 476.012127][ T44] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 476.327083][ T44] usb 4-1: Using ep0 maxpacket: 32 [ 476.359698][ T44] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 476.373604][ T44] usb 4-1: config 0 has no interface number 0 [ 476.577133][ T44] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 476.588150][ T44] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.637653][ T44] usb 4-1: Product: syz [ 476.655482][ T44] usb 4-1: Manufacturer: syz [ 476.676678][ T44] usb 4-1: SerialNumber: syz [ 476.731712][ T44] usb 4-1: config 0 descriptor?? [ 476.771225][ T44] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 477.212091][ T5916] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 477.368727][ T5916] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 477.380202][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.416017][ T5916] usb 3-1: Product: syz [ 477.432511][ T5916] usb 3-1: Manufacturer: syz [ 477.454975][ T5916] usb 3-1: SerialNumber: syz [ 477.505105][ T5916] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 477.541019][ T5909] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 477.971350][T10895] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 478.241599][T10895] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 478.357982][ T5181] usb 2-1: qt2_attach - failed to power on unit: -71 [ 478.444244][ T5181] quatech2 2-1:0.51: probe with driver quatech2 failed with error -71 [ 478.464122][ T5933] usb 3-1: USB disconnect, device number 83 [ 478.553212][ T5181] usb 2-1: USB disconnect, device number 78 [ 478.610247][ T5909] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 478.631684][ T5909] ath9k_htc: Failed to initialize the device [ 478.681549][ T5933] usb 3-1: ath9k_htc: USB layer deinitialized [ 478.764872][ T30] audit: type=1326 audit(1751649624.156:1276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10898 comm="syz.1.1421" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f929418e929 code=0x0 [ 479.212400][ T5181] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 479.333249][ T44] usb 4-1: qt2_attach - failed to power on unit: -71 [ 479.398190][ T44] quatech2 4-1:0.51: probe with driver quatech2 failed with error -71 [ 479.417447][ T5181] usb 5-1: config 0 has no interfaces? [ 479.435736][ T44] usb 4-1: USB disconnect, device number 69 [ 479.452872][ T5181] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 479.473693][ T5181] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.496855][ T5181] usb 5-1: Product: syz [ 479.541570][ T5181] usb 5-1: Manufacturer: syz [ 479.618296][ T5181] usb 5-1: SerialNumber: syz [ 479.632095][ T860] usb 1-1: new full-speed USB device number 64 using dummy_hcd [ 479.665538][ T5181] usb 5-1: config 0 descriptor?? [ 479.838916][T10922] delete_channel: no stack [ 479.875874][ T860] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 479.886493][ T860] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 479.935902][ T860] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 479.980167][ T860] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.029901][ T860] usb 1-1: config 0 descriptor?? [ 480.041065][ T5181] usb 5-1: USB disconnect, device number 83 [ 480.115448][ T860] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 480.122321][ T860] dvb-usb: bulk message failed: -22 (3/0) [ 480.140467][ T860] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 480.156471][T10926] binder: BINDER_SET_CONTEXT_MGR already set [ 480.172080][T10926] binder: 10924:10926 ioctl 4018620d 200000000040 returned -16 [ 480.192171][T10926] binder: 10924:10926 ioctl c0306201 2000000003c0 returned -14 [ 480.248764][ T860] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 480.260401][T10910] dibusb: i2c wr: len=61 is too big! [ 480.260401][T10910] [ 480.325508][T10926] bridge1: entered promiscuous mode [ 480.342910][T10926] bridge1: entered allmulticast mode [ 480.404068][T10926] team0: Port device bridge1 added [ 480.443898][ T860] usb 1-1: media controller created [ 480.466740][ T860] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 480.611529][ T860] dvb-usb: bulk message failed: -22 (6/0) [ 480.646793][ T860] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 480.728631][ T860] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input55 [ 480.801490][ T860] dvb-usb: schedule remote query interval to 150 msecs. [ 480.836780][ T860] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 481.014102][ T860] dvb-usb: bulk message failed: -22 (1/0) [ 481.115536][ T860] dvb-usb: error while querying for an remote control event. [ 481.302163][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 481.308202][ T5929] dvb-usb: error while querying for an remote control event. [ 481.452315][ T860] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 481.599107][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 481.605342][ T5929] dvb-usb: error while querying for an remote control event. [ 481.748493][ T860] usb 5-1: Using ep0 maxpacket: 16 [ 481.766515][ T860] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 481.792131][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 481.798059][ T5929] dvb-usb: error while querying for an remote control event. [ 481.861545][ T860] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 481.899984][ T860] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 481.944995][ T860] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 481.974234][ T860] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.992275][ T5181] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 482.017670][ T860] usb 5-1: Product: syz [ 482.042289][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 482.058082][ T860] usb 5-1: Manufacturer: syz [ 482.084347][ T5929] dvb-usb: error while querying for an remote control event. [ 482.102837][ T860] usb 5-1: SerialNumber: syz [ 482.181114][ T5181] usb 2-1: config 36 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 482.262580][ T5933] dvb-usb: bulk message failed: -22 (1/0) [ 482.268397][ T5933] dvb-usb: error while querying for an remote control event. [ 482.277172][ T5181] usb 2-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 482.317132][ T5181] usb 2-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 482.374968][ T5181] usb 2-1: Manufacturer: syz [ 482.391971][ T5181] usb 2-1: SerialNumber: syz [ 482.462715][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 482.471983][ T9] dvb-usb: error while querying for an remote control event. [ 482.534283][ T860] usb 5-1: 2:1 : format type 0 is detected, processed as PCM [ 482.674427][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 482.688793][ T9] dvb-usb: error while querying for an remote control event. [ 482.872135][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 482.897254][ T9] dvb-usb: error while querying for an remote control event. [ 483.062198][ T44] usb 1-1: USB disconnect, device number 64 [ 483.129977][ T44] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 483.346808][ T860] usb 5-1: failed to read current rate; disabling the check [ 483.613645][ T860] usb 5-1: USB disconnect, device number 84 [ 483.632110][ T44] usb 1-1: new full-speed USB device number 65 using dummy_hcd [ 483.778414][ T5978] udevd[5978]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 483.879609][T10981] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 483.938550][ T44] usb 1-1: config 0 has no interfaces? [ 483.949870][T10982] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 483.980834][ T44] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 484.034067][ T44] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.165459][ T5909] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 484.209832][ T44] usb 1-1: Product: syz [ 484.268240][ T44] usb 1-1: Manufacturer: syz [ 484.268307][ T5933] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 484.273070][ T44] usb 1-1: SerialNumber: syz [ 484.301374][ T44] usb 1-1: config 0 descriptor?? [ 484.447774][ T5909] usb 4-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 484.459109][ T5909] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 484.490207][ T5909] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 484.500419][ T5909] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.508837][ T5909] usb 4-1: Product: syz [ 484.584426][T10971] program syz.0.1440 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 484.595036][ T5909] usb 4-1: Manufacturer: syz [ 484.605400][ T5909] usb 4-1: SerialNumber: syz [ 484.627094][ T5933] usb 3-1: config 6 has an invalid interface number: 78 but max is 3 [ 484.636227][ T5933] usb 3-1: config 6 has an invalid interface number: 127 but max is 3 [ 484.666701][T10971] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 484.682098][T10987] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1448'. [ 484.693749][ T5181] usbhid 2-1:36.0: couldn't find an input interrupt endpoint [ 484.708470][ T5933] usb 3-1: config 6 contains an unexpected descriptor of type 0x2, skipping [ 484.711733][ T5181] usb 2-1: USB disconnect, device number 79 [ 484.724718][ T5909] hub 4-1:1.0: bad descriptor, ignoring hub [ 484.730797][ T5909] hub 4-1:1.0: probe with driver hub failed with error -5 [ 484.744735][T10971] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.780473][T10971] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 484.791497][T10971] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 484.833927][T10991] netlink: 'syz.1.1449': attribute type 1 has an invalid length. [ 484.877611][ T5933] usb 3-1: config 6 has an invalid descriptor of length 1, skipping remainder of the config [ 484.923104][ T5933] usb 3-1: config 6 has 3 interfaces, different from the descriptor's value: 4 [ 484.976794][ T5933] usb 3-1: config 6 has no interface number 0 [ 485.009744][ T5933] usb 3-1: config 6 has no interface number 2 [ 485.027165][ T5933] usb 3-1: config 6 interface 127 altsetting 7 endpoint 0x4 has invalid maxpacket 927, setting to 64 [ 485.042737][ T5909] usb 4-1: USB disconnect, device number 70 [ 485.085081][ T5933] usb 3-1: config 6 interface 127 altsetting 7 endpoint 0x3 has an invalid bInterval 50, changing to 9 [ 485.154288][ T5933] usb 3-1: config 6 interface 127 altsetting 7 has a duplicate endpoint with address 0x3, skipping [ 485.295276][ T5933] usb 3-1: config 6 interface 127 altsetting 7 has 3 endpoint descriptors, different from the interface descriptor's value: 14 [ 485.372073][ T5909] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 485.385224][ T5933] usb 3-1: config 6 interface 1 altsetting 121 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 485.512042][ T9] usb 2-1: new full-speed USB device number 80 using dummy_hcd [ 485.513769][ T5909] usb 4-1: device descriptor read/64, error -71 [ 485.536968][ T5933] usb 3-1: config 6 interface 78 has no altsetting 0 [ 485.632379][ T5933] usb 3-1: config 6 interface 127 has no altsetting 0 [ 485.676270][ T5933] usb 3-1: config 6 interface 1 has no altsetting 0 [ 485.705328][ T5933] usb 3-1: New USB device found, idVendor=1bc7, idProduct=1061, bcdDevice=3e.db [ 485.722217][ T5933] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.738155][ T5933] usb 3-1: Product: syz [ 485.749365][ T5933] usb 3-1: Manufacturer: syz [ 485.756576][ T5933] usb 3-1: SerialNumber: syz [ 485.762125][ T5909] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 485.933207][ T5909] usb 4-1: device descriptor read/64, error -71 [ 486.058349][ T5909] usb usb4-port1: attempt power cycle [ 486.063222][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 486.137678][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 486.160341][ T5933] cdc_mbim 3-1:6.78: CDC Union missing and no IAD found [ 486.211973][ T9] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 486.223590][ T5933] cdc_mbim 3-1:6.78: bind() failure [ 486.289383][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.310599][ T5933] hub 3-1:6.1: Invalid hub with more than one config or interface [ 486.335712][ T9] usb 2-1: config 0 descriptor?? [ 486.341570][ T5933] hub 3-1:6.1: probe with driver hub failed with error -22 [ 486.378363][ T9] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 486.406333][ T5933] usb 3-1: USB disconnect, device number 84 [ 486.422252][ T5909] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 486.434852][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 486.493127][ T5909] usb 4-1: device descriptor read/8, error -71 [ 486.534427][ T9] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 486.579599][T10996] dibusb: i2c wr: len=61 is too big! [ 486.579599][T10996] [ 486.632545][ T9] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 486.702494][ T9] usb 2-1: media controller created [ 486.742086][ T5909] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 486.906101][ T5181] usb 1-1: USB disconnect, device number 65 [ 487.185169][T11013] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1457'. [ 487.290867][T11016] FAULT_INJECTION: forcing a failure. [ 487.290867][T11016] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 487.320881][T11016] CPU: 1 UID: 0 PID: 11016 Comm: syz.2.1459 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 487.320904][T11016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 487.320917][T11016] Call Trace: [ 487.320924][T11016] [ 487.320932][T11016] dump_stack_lvl+0x189/0x250 [ 487.320955][T11016] ? __pfx____ratelimit+0x10/0x10 [ 487.320980][T11016] ? __pfx_dump_stack_lvl+0x10/0x10 [ 487.320997][T11016] ? __pfx__printk+0x10/0x10 [ 487.321018][T11016] ? __might_fault+0xb0/0x130 [ 487.321045][T11016] should_fail_ex+0x414/0x560 [ 487.321072][T11016] _copy_from_user+0x2d/0xb0 [ 487.321091][T11016] io_register_rsrc_update+0xb5/0x1a0 [ 487.321110][T11016] ? __fget_files+0x2a/0x420 [ 487.321131][T11016] ? __pfx_io_register_rsrc_update+0x10/0x10 [ 487.321151][T11016] ? __fget_files+0x2a/0x420 [ 487.321173][T11016] ? io_is_uring_fops+0xd/0x50 [ 487.321195][T11016] __se_sys_io_uring_register+0x5cb/0x11b0 [ 487.321217][T11016] ? __pfx___se_sys_io_uring_register+0x10/0x10 [ 487.321232][T11016] ? ksys_write+0x22a/0x250 [ 487.321251][T11016] ? __pfx_ksys_write+0x10/0x10 [ 487.321267][T11016] ? rcu_is_watching+0x15/0xb0 [ 487.321289][T11016] ? do_syscall_64+0xbe/0x3b0 [ 487.321306][T11016] do_syscall_64+0xfa/0x3b0 [ 487.321320][T11016] ? lockdep_hardirqs_on+0x9c/0x150 [ 487.321343][T11016] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.321357][T11016] ? clear_bhb_loop+0x60/0xb0 [ 487.321375][T11016] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.321389][T11016] RIP: 0033:0x7f4fc238e929 [ 487.321404][T11016] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 487.321417][T11016] RSP: 002b:00007f4fc329f038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 487.321433][T11016] RAX: ffffffffffffffda RBX: 00007f4fc25b5fa0 RCX: 00007f4fc238e929 [ 487.321444][T11016] RDX: 0000200000001180 RSI: 000000000000000e RDI: 0000000000000003 [ 487.321453][T11016] RBP: 00007f4fc329f090 R08: 0000000000000000 R09: 0000000000000000 [ 487.321462][T11016] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 487.321471][T11016] R13: 0000000000000000 R14: 00007f4fc25b5fa0 R15: 00007f4fc26dfa28 [ 487.321493][T11016] [ 487.553835][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 487.658473][ T9] dvb-usb: bulk message failed: -22 (6/0) [ 487.691152][ T9] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 487.774973][ T9] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input56 [ 487.869156][ T5909] usb 4-1: device descriptor read/8, error -71 [ 487.874464][ T9] dvb-usb: schedule remote query interval to 150 msecs. [ 487.902146][ T5933] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 487.929134][ T9] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 488.082159][ T5909] usb usb4-port1: unable to enumerate USB device [ 488.116327][ T9] dvb-usb: bulk message failed: -22 (1/0) [ 488.148082][ T9] dvb-usb: error while querying for an remote control event. [ 488.156235][ T5933] usb 1-1: Using ep0 maxpacket: 8 [ 488.172071][ T5933] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 488.181259][ T5933] usb 1-1: config 179 has no interface number 0 [ 488.212036][ T44] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 488.219796][ T5933] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 488.234973][ T5933] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 488.257924][ T5933] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 488.269567][ T5933] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 488.281717][ T5933] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 488.295789][ T5933] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 488.305131][ T5933] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 488.361536][T11027] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.374816][ T5929] dvb-usb: bulk message failed: -22 (1/0) [ 488.376003][ T44] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 488.381785][ T5929] dvb-usb: error while querying for an remote control event. [ 488.414206][T11017] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 488.431829][ T5909] usb 2-1: USB disconnect, device number 80 [ 488.441303][ T44] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 488.453873][T11027] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.484151][T11029] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1464'. [ 488.525719][ T44] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 488.559207][ T44] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 488.569957][ T5909] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 488.583480][ T9] usb 4-1: new full-speed USB device number 75 using dummy_hcd [ 488.614107][ T44] usb 5-1: Manufacturer: syz [ 488.650867][ T44] usb 5-1: config 0 descriptor?? [ 488.687257][ T5933] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input57 [ 488.728153][T11035] IPv6: Can't replace route, no match found [ 488.847956][ T5909] usb 1-1: USB disconnect, device number 66 [ 488.848018][ C0] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 488.863231][ C0] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 488.887193][ T5909] xpad 1-1:179.65: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -19 [ 488.918151][T11040] fuse: Unknown parameter 'd' [ 488.942218][ T44] rc_core: IR keymap rc-hauppauge not found [ 488.956127][ T44] Registered IR keymap rc-empty [ 488.980755][ T44] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 488.994174][ T44] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input58 [ 489.023189][ C1] igorplugusb 5-1:0.0: Error: urb status = -32 [ 489.122105][ T5933] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 489.133085][ T5181] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 489.282143][ T5933] usb 2-1: Using ep0 maxpacket: 32 [ 489.289208][ T5933] usb 2-1: config 0 has an invalid interface number: 2 but max is 0 [ 489.297336][ T5933] usb 2-1: config 0 has no interface number 0 [ 489.302272][ T5181] usb 3-1: Using ep0 maxpacket: 32 [ 489.303775][ T5933] usb 2-1: config 0 interface 2 has no altsetting 0 [ 489.316124][ T5181] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 489.318567][ T5933] usb 2-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 489.328677][ T5181] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 489.340488][ T5933] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.349001][ T5181] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 489.360644][ T5933] usb 2-1: Product: syz [ 489.374348][ T5933] usb 2-1: Manufacturer: syz [ 489.378819][ T5181] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 489.378988][ T5933] usb 2-1: SerialNumber: syz [ 489.388641][ T5933] usb 2-1: config 0 descriptor?? [ 489.398984][ T5181] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 489.416963][ T5181] usb 3-1: config 0 descriptor?? [ 489.423382][T11038] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 489.432040][ T5929] usb 5-1: USB disconnect, device number 85 [ 489.444587][ T5181] hub 3-1:0.0: USB hub found [ 489.603909][T11035] netlink: 'syz.1.1465': attribute type 13 has an invalid length. [ 489.614309][ T9] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 489.621583][T11035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 489.637209][T11035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 489.653390][ T5181] hub 3-1:0.0: 2 ports detected [ 489.686764][ T5933] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 489.709890][T11050] Invalid logical block size (65519) [ 489.748913][ T5933] usb 2-1: USB disconnect, device number 81 [ 489.789783][ T9] usb 4-1: New USB device found, idVendor=133e, idProduct=0815, bcdDevice=7e.66 [ 489.803707][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.837094][ T9] usb 4-1: Product: syz [ 489.842509][ T9] usb 4-1: Manufacturer: syz [ 489.855831][ T9] usb 4-1: SerialNumber: syz [ 489.877755][ T9] usb 4-1: config 0 descriptor?? [ 489.898960][ T9] snd-usb-audio 4-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 490.043022][T11057] kvm: user requested TSC rate below hardware speed [ 490.097566][ T5909] usb 4-1: USB disconnect, device number 76 [ 490.292054][ T44] usb 5-1: new full-speed USB device number 86 using dummy_hcd [ 490.307387][T11060] bond0: (slave netdevsim0): Releasing backup interface [ 490.379855][T11060] team0: Port device bridge1 removed [ 490.432541][ T30] audit: type=1800 audit(1751649635.836:1277): pid=11038 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1467" name="dmabuf" dev="dmabuf" ino=4 res=0 errno=0 [ 490.485508][ T44] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 490.494289][ T44] usb 5-1: can't read configurations, error -22 [ 490.632152][ T44] usb 5-1: new full-speed USB device number 87 using dummy_hcd [ 490.836170][ T44] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 490.859622][ T44] usb 5-1: can't read configurations, error -22 [ 490.895815][ T44] usb usb5-port1: attempt power cycle [ 491.042042][ T5909] usb 2-1: new full-speed USB device number 82 using dummy_hcd [ 491.090830][T11038] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.099997][T11038] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.137319][ T5181] hub 3-1:0.0: hub_ext_port_status failed (err = -71) [ 491.137744][ T5929] usb 3-1: USB disconnect, device number 85 [ 491.242064][ T44] usb 5-1: new full-speed USB device number 88 using dummy_hcd [ 491.267095][ T44] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 491.278713][ T44] usb 5-1: can't read configurations, error -22 [ 491.288014][ T5909] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 491.307752][ T5909] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 491.317101][ T5909] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 491.326302][ T5909] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.337360][ T5909] usb 2-1: config 0 descriptor?? [ 491.357846][ T5909] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 491.365454][ T5909] dvb-usb: bulk message failed: -22 (3/0) [ 491.399412][ T5909] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 491.408781][ T5909] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 491.417341][ T5909] usb 2-1: media controller created [ 491.424876][ T5909] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 491.449022][ T5909] dvb-usb: bulk message failed: -22 (6/0) [ 491.454981][ T44] usb 5-1: new full-speed USB device number 89 using dummy_hcd [ 491.475086][ T5909] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 491.484931][ T44] usb 5-1: config index 0 descriptor too short (expected 9, got 0) [ 491.493940][ T44] usb 5-1: can't read configurations, error -22 [ 491.500649][ T44] usb usb5-port1: unable to enumerate USB device [ 491.559231][ T5909] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input59 [ 491.563667][T11069] dibusb: i2c wr: len=61 is too big! [ 491.563667][T11069] [ 491.591671][ T5909] dvb-usb: schedule remote query interval to 150 msecs. [ 491.616013][ T5909] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 491.773356][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 491.781684][ T44] dvb-usb: error while querying for an remote control event. [ 491.952077][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 491.958031][ T44] dvb-usb: error while querying for an remote control event. [ 492.054530][ T30] audit: type=1326 audit(1751649637.456:1278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11076 comm="syz.2.1478" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4fc238e929 code=0x0 [ 492.132456][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 492.138352][ T44] dvb-usb: error while querying for an remote control event. [ 492.302007][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 492.307939][ T44] dvb-usb: error while querying for an remote control event. [ 492.392252][ T5909] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 492.472062][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 492.477938][ T44] dvb-usb: error while querying for an remote control event. [ 492.572022][ T5909] usb 4-1: Using ep0 maxpacket: 16 [ 492.578253][ T5909] usb 4-1: too many configurations: 98, using maximum allowed: 8 [ 492.588286][ T5909] usb 4-1: config 6 has no interfaces? [ 492.595170][ T5909] usb 4-1: config 6 has no interfaces? [ 492.601921][ T5909] usb 4-1: config 6 has no interfaces? [ 492.608512][ T5909] usb 4-1: config 6 has no interfaces? [ 492.615453][ T5909] usb 4-1: config 6 has no interfaces? [ 492.622024][ T5909] usb 4-1: config 6 has no interfaces? [ 492.628763][ T5909] usb 4-1: config 6 has no interfaces? [ 492.636191][ T5909] usb 4-1: config 6 has no interfaces? [ 492.653426][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 492.659265][ T44] dvb-usb: error while querying for an remote control event. [ 492.668926][ T5909] usb 4-1: string descriptor 0 read error: -71 [ 492.681224][ T5909] usb 4-1: New USB device found, idVendor=09c0, idProduct=0200, bcdDevice=58.3c [ 492.690643][ T5909] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=154 [ 492.701506][ T5909] usb 4-1: rejected 8 configurations due to insufficient available bus power [ 492.711749][ T5909] usb 4-1: no configuration chosen from 8 choices [ 492.721621][ T5909] usb 4-1: USB disconnect, device number 77 [ 492.822230][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 492.828464][ T44] dvb-usb: error while querying for an remote control event. [ 492.992152][ T44] dvb-usb: bulk message failed: -22 (1/0) [ 492.998284][ T44] dvb-usb: error while querying for an remote control event. [ 493.182316][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 493.193315][ T5909] dvb-usb: error while querying for an remote control event. [ 493.382072][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 493.409147][ T5909] dvb-usb: error while querying for an remote control event. [ 493.564502][T11088] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 493.582111][ T5909] dvb-usb: bulk message failed: -22 (1/0) [ 493.589215][ T5909] dvb-usb: error while querying for an remote control event. [ 493.682046][ T5929] usb 2-1: USB disconnect, device number 82 [ 493.754469][ T5929] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 493.902392][ T5909] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 494.049446][T11105] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 494.084382][ T5909] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 494.104917][ T5909] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 494.125229][ T5909] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 494.155897][ T5909] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 494.166751][ T5909] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.175134][ T5909] usb 5-1: Product: syz [ 494.180457][ T5909] usb 5-1: Manufacturer: syz [ 494.186923][ T5909] usb 5-1: SerialNumber: syz [ 494.194860][T11100] netlink: 'syz.2.1486': attribute type 10 has an invalid length. [ 494.205456][ T5909] hub 5-1:1.0: bad descriptor, ignoring hub [ 494.212491][ T5909] hub 5-1:1.0: probe with driver hub failed with error -5 [ 494.239312][T11100] team0: Port device veth1_macvtap added [ 494.312212][ T5929] usb 2-1: new full-speed USB device number 83 using dummy_hcd [ 494.419767][ T5909] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 90 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 494.487628][ T5929] usb 2-1: config 0 has an invalid interface number: 20 but max is 0 [ 494.512337][ T5929] usb 2-1: config 0 has no interface number 0 [ 494.529284][ T5929] usb 2-1: config 0 interface 20 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 494.545702][ T5929] usb 2-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 494.555301][ T5929] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.568405][ T5929] usb 2-1: Product: syz [ 494.583439][T11112] ================================================================== [ 494.591587][T11112] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 494.600256][T11112] Write of size 320 at addr ffffc9000e341ef1 by task vivid-000-vid-c/11112 [ 494.608887][T11112] [ 494.611270][T11112] CPU: 0 UID: 0 PID: 11112 Comm: vivid-000-vid-c Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 494.611299][T11112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 494.611313][T11112] Call Trace: [ 494.611323][T11112] [ 494.611332][T11112] dump_stack_lvl+0x189/0x250 [ 494.611365][T11112] ? __pfx_dump_stack_lvl+0x10/0x10 [ 494.611391][T11112] ? __pfx__printk+0x10/0x10 [ 494.611421][T11112] ? __pfx__printk+0x10/0x10 [ 494.611446][T11112] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 494.611479][T11112] ? __virt_addr_valid+0xdc/0x5c0 [ 494.611508][T11112] print_report+0xd2/0x2b0 [ 494.611528][T11112] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 494.611551][T11112] kasan_report+0x118/0x150 [ 494.611580][T11112] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 494.611607][T11112] kasan_check_range+0x2b0/0x2c0 [ 494.611634][T11112] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 494.611658][T11112] __asan_memcpy+0x40/0x70 [ 494.611680][T11112] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 494.611742][T11112] vivid_thread_vid_cap_tick+0xfff/0x5fd0 [ 494.611790][T11112] ? ktime_get+0x3e/0x1f0 [ 494.611821][T11112] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 494.611852][T11112] ? lockdep_hardirqs_on+0x9c/0x150 [ 494.611885][T11112] vivid_thread_vid_cap+0x8da/0x10d0 [ 494.611924][T11112] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 494.611944][T11112] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 494.611972][T11112] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 494.612013][T11112] ? __kthread_parkme+0x7b/0x200 [ 494.612040][T11112] ? __kthread_parkme+0x1a1/0x200 [ 494.612068][T11112] kthread+0x70e/0x8a0 [ 494.612098][T11112] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 494.612118][T11112] ? __pfx_kthread+0x10/0x10 [ 494.612146][T11112] ? _raw_spin_unlock_irq+0x23/0x50 [ 494.612176][T11112] ? lockdep_hardirqs_on+0x9c/0x150 [ 494.612205][T11112] ? __pfx_kthread+0x10/0x10 [ 494.612233][T11112] ret_from_fork+0x3fc/0x770 [ 494.612257][T11112] ? __pfx_ret_from_fork+0x10/0x10 [ 494.612281][T11112] ? __switch_to_asm+0x39/0x70 [ 494.612307][T11112] ? __switch_to_asm+0x33/0x70 [ 494.612333][T11112] ? __pfx_kthread+0x10/0x10 [ 494.612362][T11112] ret_from_fork_asm+0x1a/0x30 [ 494.612398][T11112] [ 494.612406][T11112] [ 494.830198][T11112] The buggy address belongs to the virtual mapping at [ 494.830198][T11112] [ffffc9000e341000, ffffc9000e343000) created by: [ 494.830198][T11112] vb2_vmalloc_alloc+0xef/0x340 [ 494.848316][T11112] [ 494.850681][T11112] The buggy address belongs to the physical page: [ 494.857141][T11112] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028a0f000 pfn:0x28a0f [ 494.867252][T11112] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 494.874432][T11112] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 494.883168][T11112] raw: ffff888028a0f000 0000000000000000 00000001ffffffff 0000000000000000 [ 494.891800][T11112] page dumped because: kasan: bad access detected [ 494.898434][T11112] page_owner tracks the page as allocated [ 494.904191][T11112] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_NOWARN), pid 11111, tgid 11107 (syz.3.1490), ts 494568111155, free_ts 494568087816 [ 494.922734][T11112] post_alloc_hook+0x240/0x2a0 [ 494.927558][T11112] get_page_from_freelist+0x21e4/0x22c0 [ 494.933166][T11112] __alloc_frozen_pages_noprof+0x181/0x370 [ 494.939025][T11112] alloc_pages_bulk_noprof+0x560/0x710 [ 494.944543][T11112] alloc_pages_bulk_mempolicy_noprof+0x341/0x1650 [ 494.951097][T11112] __vmalloc_node_range_noprof+0x733/0x12f0 [ 494.957067][T11112] vmalloc_user_noprof+0xad/0xf0 [ 494.962065][T11112] vb2_vmalloc_alloc+0xef/0x340 [ 494.966984][T11112] __vb2_queue_alloc+0x9bf/0x15a0 [ 494.972079][T11112] vb2_core_reqbufs+0xc31/0x1420 [ 494.977160][T11112] __vb2_init_fileio+0x318/0xff0 [ 494.982152][T11112] __vb2_perform_fileio+0x284/0x1600 [ 494.987487][T11112] vb2_fop_read+0x273/0x360 [ 494.992035][T11112] v4l2_read+0x19c/0x2c0 [ 494.996320][T11112] vfs_read+0x200/0x980 [ 495.000522][T11112] __x64_sys_pread64+0x193/0x220 [ 495.005509][T11112] page last free pid 11111 tgid 11107 stack trace: [ 495.012049][T11112] __free_frozen_pages+0xc71/0xe70 [ 495.017218][T11112] kasan_populate_vmalloc+0x18a/0x1a0 [ 495.022635][T11112] alloc_vmap_area+0xd51/0x1490 [ 495.027533][T11112] __get_vm_area_node+0x1f8/0x300 [ 495.032609][T11112] __vmalloc_node_range_noprof+0x301/0x12f0 [ 495.038700][T11112] vmalloc_user_noprof+0xad/0xf0 [ 495.043694][T11112] vb2_vmalloc_alloc+0xef/0x340 [ 495.048598][T11112] __vb2_queue_alloc+0x9bf/0x15a0 [ 495.053673][T11112] vb2_core_reqbufs+0xc31/0x1420 [ 495.058657][T11112] __vb2_init_fileio+0x318/0xff0 [ 495.063645][T11112] __vb2_perform_fileio+0x284/0x1600 [ 495.068997][T11112] vb2_fop_read+0x273/0x360 [ 495.073631][T11112] v4l2_read+0x19c/0x2c0 [ 495.078198][T11112] vfs_read+0x200/0x980 [ 495.082407][T11112] __x64_sys_pread64+0x193/0x220 [ 495.087404][T11112] do_syscall_64+0xfa/0x3b0 [ 495.091983][T11112] [ 495.094430][T11112] Memory state around the buggy address: [ 495.100091][T11112] ffffc9000e341f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 495.108205][T11112] ffffc9000e341f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 495.116312][T11112] >ffffc9000e342000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 495.124415][T11112] ^ [ 495.128523][T11112] ffffc9000e342080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 495.136627][T11112] ffffc9000e342100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 495.144725][T11112] ================================================================== [ 495.155441][ T5929] usb 2-1: Manufacturer: syz [ 495.160126][ T5929] usb 2-1: SerialNumber: syz [ 495.187184][ T5929] usb 2-1: config 0 descriptor?? [ 495.197302][T11105] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 495.225164][ T5929] ums-sddr09 2-1:0.20: USB Mass Storage device detected [ 495.306724][T11112] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 495.314008][T11112] CPU: 0 UID: 0 PID: 11112 Comm: vivid-000-vid-c Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) [ 495.326546][T11112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 495.336733][T11112] Call Trace: [ 495.340052][T11112] [ 495.343025][T11112] dump_stack_lvl+0x99/0x250 [ 495.347669][T11112] ? __asan_memcpy+0x40/0x70 [ 495.352296][T11112] ? __pfx_dump_stack_lvl+0x10/0x10 [ 495.357512][T11112] ? __pfx__printk+0x10/0x10 [ 495.362144][T11112] panic+0x2db/0x790 [ 495.366065][T11112] ? __pfx_panic+0x10/0x10 [ 495.370503][T11112] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 495.376422][T11112] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 495.382777][T11112] ? print_memory_metadata+0x314/0x400 [ 495.388257][T11112] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 495.393949][T11112] check_panic_on_warn+0x89/0xb0 [ 495.398926][T11112] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 495.404579][T11112] end_report+0x78/0x160 [ 495.408945][T11112] kasan_report+0x129/0x150 [ 495.413479][T11112] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 495.419248][T11112] kasan_check_range+0x2b0/0x2c0 [ 495.424217][T11112] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 495.429886][T11112] __asan_memcpy+0x40/0x70 [ 495.434337][T11112] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 495.439861][T11112] vivid_thread_vid_cap_tick+0xfff/0x5fd0 [ 495.445723][T11112] ? ktime_get+0x3e/0x1f0 [ 495.450097][T11112] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 495.456324][T11112] ? lockdep_hardirqs_on+0x9c/0x150 [ 495.461560][T11112] vivid_thread_vid_cap+0x8da/0x10d0 [ 495.466884][T11112] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 495.472662][T11112] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 495.478622][T11112] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 495.485087][T11112] ? __kthread_parkme+0x7b/0x200 [ 495.490065][T11112] ? __kthread_parkme+0x1a1/0x200 [ 495.495162][T11112] kthread+0x70e/0x8a0 [ 495.499270][T11112] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 495.505033][T11112] ? __pfx_kthread+0x10/0x10 [ 495.509654][T11112] ? _raw_spin_unlock_irq+0x23/0x50 [ 495.514928][T11112] ? lockdep_hardirqs_on+0x9c/0x150 [ 495.520433][T11112] ? __pfx_kthread+0x10/0x10 [ 495.525080][T11112] ret_from_fork+0x3fc/0x770 [ 495.529710][T11112] ? __pfx_ret_from_fork+0x10/0x10 [ 495.534861][T11112] ? __switch_to_asm+0x39/0x70 [ 495.539677][T11112] ? __switch_to_asm+0x33/0x70 [ 495.544477][T11112] ? __pfx_kthread+0x10/0x10 [ 495.549096][T11112] ret_from_fork_asm+0x1a/0x30 [ 495.553898][T11112] [ 495.557309][T11112] Kernel Offset: disabled [ 495.561670][T11112] Rebooting in 86400 seconds..